Cybersecurity researchers have uncovered a typosquatting campaign targeting RubyGems users with a Windows-based information stealer. The campaign, tracked as StubMaker by OpenSourceMalware,…
StubMaker is a typosquatting campaign targeting RubyGems users with a Windows-based information stealer. It uses malicious gems with extconf.rb hooks to deliver…
CVE-2025-6514 is a vulnerability in mcp-remote, an OAuth proxy for MCP servers, that allows a malicious MCP server to trigger OS command…
LiteLLM is an open-source AI gateway used to connect applications with multiple model providers. Versions 1.82.7 and 1.82.8 were compromised in a…
Mercor, an AI talent platform, reported that it was affected by malicious LiteLLM versions and contained unauthorized activity. The company is among…
CVE-2026-33634 is a critical vulnerability in the Trivy scanner ecosystem, exploited in a supply-chain attack that also affected LiteLLM. Added to CISA's…
Mozilla has revoked the cryptographic signing key used for Firefox and Thunderbird downloads on Linux after an unencrypted copy of the key…
CVE-2026-18072 is a vulnerability in the Advanced Responsive Video Embedder WordPress plugin that was exploited in a supply chain attack to grant…
BdThemes is a WordPress plugin vendor whose plugins were compromised in a supply chain attack via poisoned JSON data, leading to temporary…
ViPNet is a product suite by InfoTeCS that provides secure communications. Its update mechanism was hijacked in the HelloNet attack to sideload…