Development & Open Source
Software development and open source follows supply chain, dependencies, tooling, repositories and code security. The cluster highlights vulnerabilities, updates and useful practices for developers and maintainers.
Veradigm: Vendor API Breach Exposes Millions of Patient Records
Veradigm disclosed a patient data breach caused by a compromised vendor API. The Gentlemen ransomware gang claims 3.5 million records,…
CVE-2026-19780: RCE in Koha Puts Library Management Systems at Risk
An eval code injection flaw in the open-source Koha library system enables authenticated remote code execution. CVSS 8.8, patched acro…
npm: Known Worm Evades Registry Malware Scanning After 111-Day Dormancy
The Shai-Hulud npm worm resurfaced on September 7, 2026 with the identical SHA-256 hash documented four months earlier, bypassing the…
PoisonedRefresh: The Memory-Only Web Shell That Evades Disk Forensics on F5 BIG-IP APM
PoisonedRefresh infects F5 BIG-IP APM servers by exploiting CVE-2025-53521 and hides its web shell exclusively in memory, leaving on-d…
OWASP Launches OASIS: AI and AppSec Join Forces Against Open-Source Vulnerabilities
OWASP unveiled OASIS on August 26, 2026, a community project that pairs AI-generated patches with human AppSec validation to accelerat…
HAProxy Turned Trojan: North Korean APT Weaponizes the Load Balancer
Rapid7 Labs has uncovered a Linux toolkit that weaponizes HAProxy itself. A source-level backdoor, watchdog thread, and polymorphic st…
Dirty Frag: The Linux Kernel Bug That Bypasses Every Container Scanner
Dirty Frag exploits three CVEs in the Linux kernel to corrupt the page cache and gain root. The problem isn't in Docker images—it's in…
"ted" Backdoor in HAProxy: Load Balancer Turned Spy in South Korea
Rapid7 Labs uncovered a previously undocumented Linux toolkit that injects the "ted" backdoor into HAProxy 2.8.12 to intercept traffic…
Node.js Turns Trojan Horse: Signed Runtime Hides Targeted Malware
Symantec uncovers threat actors abusing node.exe — a legitimate, signed binary — to deliver malicious payloads against government and…
GitHub Reveals the True Cost of Ingesting Threat Intelligence at Scale
The Dependabot lead details how ingesting 18 malicious packages per day across 30 million repositories demanded more validation engine…
FulcrumSec Steals 86 GB of MAG Data: API Keys Were Hardcoded in Client-Side JavaScript
The FulcrumSec data extortion group claimed responsibility for the Manchester Airports Group breach, publishing ~86 GB of data. Access…
Aurora Ransomware Group Abuses AI Cursor Agent for Post-Compromise Attacks
The Aurora ransomware group used the AI-powered Cursor Agent with Claude Sonnet as an interactive operational assistant during active…