Know what changed. Know what matters.

New CSS attacks allow theft of passwords on popular webmail services.

A critical flaw in Metabase’s business intelligence platform lets attackers inject arbitrary SQL and gain full admin control without authentication.

A new campaign has pushed almost 800 malicious npm packages into the registry, all of which ship cross-platform malware that installs a remote access trojan and steals sensitive data across Windows, macOS, and Linux systems.

A long‑standing use‑after‑free bug in Linux's SCTP networking code now allows local users to gain full root privileges on the host and break out of containers.

A newly discovered Linux kernel flaw lets privileged code inside a nested virtual machine escape isolation and run on its host.

A new Senate report attributes more than $20 billion in consumer losses to data‑broker practices that enable sophisticated scams.

A zero‑auth flaw in Gitea’s Org-mode rendering lets attackers read server files.

A credential‑stealing npm worm linked to keyv@6.0.0 infected at least 868 packages, planting AI‑generated malicious hooks in August.

cPanel has released a patch for an SQL injection flaw that let authenticated customers execute commands as the database’s root user.

Malware can hijack Google Password Manager passkeys on Windows machines, bypassing biometric authentication.

A critical vulnerability in Adobe’s marketing platform allows attackers to execute arbitrary code on affected servers.