News
Straight from the wire: security alerts, releases and supply-chain stories — newest first.
Ethersphere Supply Chain Compromise: Malicious bee-js 13.3.0 and Swarm Desktop 0.56.2
A supply-chain attack hit Ethersphere’s own release pipeline: malicious bee-js 13.3.0 on npm and Swarm Desktop 0.56.2 carry a loader that steals Swarm node wallet keys and installs persistence on Linux, macOS and Windows.
Binance Breach: $6.3 Billion — the Largest Crypto Theft on Record
Attackers made off with roughly $6.3 billion in a breach Binance says started with fake job interviews and call-related malware aimed at the exchange's own engineers — the largest crypto theft to date.
PHP2Shell: Critical RCE Vulnerabilities in PHP Core
The PHP Group patched two critical core flaws (CVE-2026-109618, CVE-2026-109619, rated 9.2) that allow unauthenticated remote code execution; exploitation in the wild is confirmed and CISA urges immediate patching.
Canonical Releases Ubuntu 24.04 Noble Numbat
Canonical has announced the release of Ubuntu 24.04 LTS, codenamed Noble Numbat, available to download and install from ubuntu.com.
Critical Crypto Bug Fixed in PuTTY
Many versions of the PuTTY client have a subtle vulnerability that can allow an attacker to compromise some private keys and then forge signatures to log into remote servers.
New Technique to Trick Developers Detected in an Open Source Supply Chain Attack
Cybercriminals were discovered cleverly manipulating GitHub's search functionality and using meticulously crafted repositories to distribute malware.
Ubuntu 24.10 and Debian 13 Trixie to Feature New CLI
The APT 3.0 package manager is getting a completely revamped UI with columnar display, support for colors, and much more.
CVE-2024-3094: Critical RCE Vulnerability in XZ Utils
A critical supply chain compromise has been detected in XZ Utils versions 5.6.0 and 5.6.1, which may lead to remote code execution (RCE) via SSH authentication on affected distributions.
Vulnerability Management: Beyond Patching
An article explores the evolving landscape of vulnerability management, delving deeper than mere patching — from NIST framework core functions to PCI DSS and ISO 27001/27002 compliance changes and the role of Zero Trust.