Watchfire feed

Machine-readable: news.json · RSS · per topic: npm pypi rust go ai-tools ci-cd vulns snare. Read it at https://fresh-reads.lovable.app/.

• Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script The Hacker News · reported · 2026-11-01
• NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection The Hacker News · reported · 2026-11-01
• 1 malicious packages published on 2026-11-01 (pypi 1) GitHub Advisory Database · confirmed · 2026-11-01
• 7 malicious packages published on 2026-10-31 (pypi 5, npm 2) GitHub Advisory Database · confirmed · 2026-10-31
• Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution GitHub Advisory Database · confirmed · 2026-10-30
• imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution GitHub Advisory Database · confirmed · 2026-10-30
• “Black October” for AI Developer Platforms Wiz · confirmed · 2026-10-30
• pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI GitHub Advisory Database · confirmed · 2026-10-30
• AI agent security in Kubernetes: Why prompt injection isn't the right term Aikido · confirmed · 2026-10-30
• 27 malicious packages published on 2026-10-30 (npm 23, pypi 4) GitHub Advisory Database · confirmed · 2026-10-30
• Threat Researcher’s Notebook: How Attackers Redirect Crypto Payments ReversingLabs · confirmed · 2026-10-30
• Malicious Claude Code extension on Cursor planted SSH backdoors BleepingComputer · reported · 2026-10-30
• Actively exploited: Ivanti Connect Secure (CVE-2026-118527) CISA KEV · confirmed · 2026-10-30
• Actively exploited: Ivanti Connect Secure (CVE-2026-111357) CISA KEV · confirmed · 2026-10-30
• Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines StepSecurity · confirmed · 2026-10-30
• Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace Socket · confirmed · 2026-10-30
• Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor The Hacker News · reported · 2026-10-30
• CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV The Hacker News · reported · 2026-10-30
• 43 malicious packages published on 2026-10-29 (npm 40, pypi 3) GitHub Advisory Database · confirmed · 2026-10-29
• Hugging Face malware campaign returns to hijack GPUs for crypto mining BleepingComputer · reported · 2026-10-29
• Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware BleepingComputer · reported · 2026-10-29
• Chrome extensions with 13.4 million installs caught hijacking searches BleepingComputer · reported · 2026-10-29
• Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners The Hacker News · reported · 2026-10-29
• The Rise of Agentic Attacks: What They Look Like, and Where They're Headed Wiz · confirmed · 2026-10-29
• 3 Ways AI Agents Already Operate in Your Browser BleepingComputer · reported · 2026-10-29
• Actively exploited: GitLab Community Edition and Enterprise Edition (CVE-2026-97229) CISA KEV · confirmed · 2026-10-29
• Actively exploited: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software (CVE-2026-76418) CISA KEV · confirmed · 2026-10-29
• New Cisco firewall zero-day exploited to crash SSL VPN devices BleepingComputer · reported · 2026-10-29
• Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls The Hacker News · reported · 2026-10-29
• GitHub Launches npm Firewall to Block Malicious Packages Before Installation The Hacker News · reported · 2026-10-29
• Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys The Hacker News · reported · 2026-10-29
• China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility The Hacker News · reported · 2026-10-29
• Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users Socket · confirmed · 2026-10-29
• Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder Datadog Security Labs · confirmed · 2026-10-29
• 21 malicious packages published on 2026-10-28 (npm 20, pypi 1) GitHub Advisory Database · confirmed · 2026-10-28
• Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it GitHub Advisory Database · confirmed · 2026-10-28
• Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm br_table instruction GitHub Advisory Database · confirmed · 2026-10-28
• zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE GitHub Advisory Database · confirmed · 2026-10-28
• Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns The Hacker News · reported · 2026-10-28
• Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S. The Hacker News · reported · 2026-10-28
• Volt Typhoon hides zero-day attacks using 'Silent Train' framework BleepingComputer · reported · 2026-10-28
• Even after PHP2Shell, blast radius matters more than a CVSS score BleepingComputer · reported · 2026-10-28
• Actively exploited: Broadcom VMware ESX (CVE-2026-41709) CISA KEV · confirmed · 2026-10-28
• Actively exploited: Linux Kernel (CVE-2026-46300) CISA KEV · confirmed · 2026-10-28
• Aikido launches external network pentesting Aikido · confirmed · 2026-10-28
• ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws The Hacker News · reported · 2026-10-28
• 27 malicious packages published on 2026-10-27 (npm 25, pypi 2) GitHub Advisory Database · confirmed · 2026-10-27
• MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules GitHub Advisory Database · confirmed · 2026-10-27
• Hackers hijack Convertr analytics script to steal payment card data BleepingComputer · reported · 2026-10-27
• CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets The Hacker News · reported · 2026-10-27