Yes, we heard about the #ChatMoss / #WhenSunset #VSCode extension that appears to be malicious. We reported it to the marketplace on 31. Oct 2025. It's not new, it's not news, but it is a good reminder to be cautious; marketplaces don't always remove sketchy extensions. #Malware #SupplyChainSecurity

As of 16. Jan 2026, this chart shows the number of #CVE submissions in "Awaiting Analysis" status in the US-NVD Unless something changes with #NVD's capacity (which seems unlikely given NIST's current priorities), we as an industry need to find a different path. This isn't sustainable.

This #LastWeekInAppSec is a great reminder that automation and dev tooling is part of an organizations attack surface. #Sigstore, #pnpm, and #n8n all have vulns to pay attention to, but (mostly) not panic over. 👉 should you worry? read: buff.ly/ATRNVz3 #AppSec #ProductSecurity #DevSecOps #DevOps

🚨 Alert #WeKnora users! 2 High Severity #CVEs were released. CVE-2026-22687: #SQLi in the Agent service DB query tool. Due to insufficient backend checks an attacker can use prompt‑based bypass to avoid query restrictions and obtain sensitive information from the server and DB. buff.ly/kQXicrG

Checkmarx Zero has contributed some of our work on Lies-in-the-Loop to the OWASP foundation. Thanks to our own Ori Ron for the efforts there, and to the OWASP community for the review and process of getting this important attack pattern documented with OWASP See: buff.ly/KNzcahw

🚨 Malicious VS Code extension impersonating Solidity publishers: juanblan281.solid281 ; drops persistent remote-access kits on Windows, macOS, and Linux. If found on machines, quarantine and clean carefully. 🧵 1/3 #VSCode #Malware #AppSec #Developer #Solidity

It's been a busy couple of weeks for #AppSec; including ongoing named vulns like React2Shell and MongoBleed, because what's a #vuln without a Brand™? Also AdonisJS, RustFS, and the Shai-Hulud that didn't happen 📑 READ more: buff.ly/xbVornQ #JavaScript #npm #MongoDB #React #Rust

🚨 CVE-2026-21877 – #RCE in #n8n via Arbitrary File Write Authenticated users may upload crafted files that could trigger remote code execution, potentially leading to full instance compromise, affecting both self-hosted and cloud instances. Patch version 1.121.3+. More information:

#HuggingFace is great, but supply chain attacks against it and similar registries may mean you're potentially accepting some pretty toxic hugs from strangers. Do you know what to look for, and how to avoid adopting malicious models into your #AI workflows? 👉 buff.ly/1vNZNbv

2025 wasn’t all new vulns and bad news for AppSec. It also brought real, material wins for developers and defenders: safer defaults, harder supply-chain abuse, better collaboration, and risk reductions that don’t slow teams down.

🚨 Attention MongoDB users: if you have yet to update your MongoDB to its latest version - now is the time to do so as it is currently being exploited in the wild. CVE-2025-14847, dubbed "MongoBleed", is a zlib buffer overread which allows attackers to read arbitrary server memory. #AppSec #MongoDB

🚨CVE-2025-68613: Critical RCE in n8n via expression injection. Auth users can craft workflow expressions that escape isolation and execute code as the n8n process risking full instance compromise. Patch: upgrade to v1.122.0+ (1.120.4/1.121.1/1.122.0). More info: devhub.checkmarx.com/cve-details/...

We're working through the final stages of disclosure with several orgs who have been impacted by evolved forms of supply chain attacks targeting their LLM ecosystems on HuggingFace. 🧵 #AI #SoftwareSupplyChain #LLM #ModelConfusion #ModelJacking #SupplyChainRisk #HuggingFace

🚨 #Windows users of #NPM systeminformation be aware of #CVE-2025-68154. The fsSize function is vulnerable to OS Command #Injection. The drive parameter is added to a PowerShell command directly, allowing arbitrary commands when user input hits fsSize(). Upgrade to v5.27.14 Details: buff.ly/xexR3dP

The very safeguards that your AI agents put in place to make sure you know what they're executing on your machine can be turned into weapons that put your data at risk. Read at Checkmarx Zero: buff.ly/uWNTb5O 🧵1/4

A pentesting AI agent pwned with an HTML comment on a target server? That's actually kind of funny on the one hand, but deeply concerning on the other. CVE-2025-67511 references a critical, ‼️unpatched‼️ command injection issue in the CAI pentesting agent Details and mitigation: buff.ly/x6gPiPf 🧵 1/4

‼️ A critical issue has landed for anyone building with Elysia.js. CVE-2025-66456 allows attackers to achieve remote code execution through a prototype-pollution pathway in certain schema-validation flows. buff.ly/RCQHiLI #ElysiaJS #CVE202566456 #RCE #AppSec #NodeSecurity #TypeScript 🧵1/5

🏰 Zitadel identity manager has 3 serious vulns to patch that could leave organizations at serious risk, including account takeovers and reading of sensitive data. #SupplyChainSecrity #Vulnerability #ProductSecurity #InformationSecurity #CyberSecurity #Patch #Zitadel

Checkmarx Zero researcher Bruno Dias takes a deep dive inside Shai-Hulud's maw to examine how the world's first worm wreaked havoc on the NPM ecosystem — twice. Read "Inside Shai-Hulud's Maw": buff.ly/N5Men7d

🚨 CVE-2025-65959 | Open WebUI | Stored XSS via Notes PDF Download (High) Malicious SVG/HTML in Markdown notes can execute JavaScript when downloaded as PDF, enabling session token theft. All users are at risk. Affects versions < 0.6.37. buff.ly/EVaSAOB buff.ly/RFK4ZIl

📣 Within hours of disclosure, threat actors began probing and exploiting #React2Shell (CVE-2025-55182), and the #CVE has now been added to CISA’s KEV catalog. If you run React Server Components, Next.js, or dependent frameworks, patch immediately. More details: buff.ly/PPd3QsF #AppSec

We took down 6 more malicious #VSCode packages that seem to be an evolved brandjacking attack similar the attack on Prettier we previously took down. List of extensions and additional info: buff.ly/wxviY9d #SupplyChainSecurity #DeveloperSecurity #ExtensionSecurity #VisualStudioCode

#React2Shell is not to be underestimated: this RCE vulnerability in React also impacts Next.js, and can result in attackers executing arbitrary commands on your servers. It can be hard to be sure that you're not using the affected components, so upgrade as soon as you possibly can! buff.ly/PPd3QsF

#LastWeekInAppSec was a busy one! Not only did we have #ShaiHulud rear its head again, but a number of big patching efforts came up as well 🧵1/5 Get details and analysis here: buff.ly/T63yQWd

🚨 #CVE-2025-41115: critical vulnerability in #Grafana user identity handling. Update to the latest platform version. #Vulnerable versions with #SCIM provisioning enabled can let a malicious SCIM client use a numeric “externalId" to override user IDs, risking impersonation or privilege escalation.

🚨 CVE-2025-62155 | New API — SSRF Redirect Bypass (High) A new SSRF vulnerability in New API allows bypassing a previous fix using HTTP 302 redirects, enabling malicious requests to access internal resources by only validating the first URL. Patch: Update to v0.9.6 buff.ly/iPMLSlT

We just took down a particularly nasty piece of VSCode extension malware posing as a “Prettier” alternative. It deployed an Anivia Stealer variant that exfiltrates credentials and even private chat data. We got it down in 4 hours. buff.ly/TRAMPpN #VSCode #Malware #SupplyChainSecurity #AppSec 🧵1/5

Running vLLM in production? There’s a crashing bug that can lead to DoS and even potential RCE. If you handle untrusted inputs, this one matters. Details ➜ buff.ly/a5dVfj5 #vLLM #AIVulnerability #LLMSecurity #PyTorch #AppSec #DevSecOps 🧵1/4

A CVSS 2.9 vulnerability in a dependency isn’t supposed to wreck availability… yet that’s exactly what happened to HAProxy. A “low-severity” supply-chain flaw escalated into a high-severity DoS risk. Curious how? Read more: buff.ly/LSA5qfq #AppSec #SupplyChainSecurity #DoS #HAProxy 🧵1/6

🚨 High-risk 7-Zip issue: CVE-2025-11001 enables directory traversal → remote code execution via crafted ZIPs containing malicious symlinks. Versions <25.00 are affected. Admins and CI/CD owners should review immediately. #7zip #RCE #DirectoryTraversal #AppSec #SoftwareSecurity buff.ly/k6Tv0YL 🧵1/4

A high-severity flaw in the glob NPM CLI (230M weekly downloads) enables command injection via malicious filenames. CVE-2025-64756 (CVSS 7.5) details + fixes: buff.ly/Nwqkdfz #NPM #JavaScript #OpenSourceSecurity #AppSec #SupplyChainSecurity 🧵1/4

#LastWeekInAppSec brings two cases where “safe by design” didn’t hold up — an #NPM math sandbox with an RCE flaw, and an #AI workflow tool with dangerous password-change logic. Full roundup: buff.ly/YrPW8GN 🧵1/4

VSCode extensions can be malicious?! Yep: and Checkmarx Zero works to identify them and take them down. Two of our researchers dive into an older finding to show you how these extensions trick developers and abuse their trust. And how we got them taken down. buff.ly/VnHjSrH

🚨 New activity in North Korea’s “Contagious Interview” NPM attack campaign — or at least the same tactics back in play. We’ve uncovered 13 additional malicious packages, on top of hundreds already disclosed. #SupplyChainSecurity #NPM #CyberThreat #ContagiousInterview 🧵1/6

☔️ #LastWeekInAppSec (Nov 11) highlights two low-severity issues with interesting implications for real-world #AppSec and #DevSecOps. 🔗 buff.ly/wN1crc3 🧵1/4

🚨 Critical #Django #Vulnerability 🚨 CVE-2025-64459 (CVSSv3 9.1) → buff.ly/kfcbY7e A newly disclosed flaw affects: • 5.1 (< 5.1.14) • 4.2 (< 4.2.26) • 5.2 (< 5.2.8) #AppSec #Python #WebSecurity 🧵1/5

BleepingComputer reports a new malware campaign (#SesameOp) abusing #OpenAI APIs as a #C2 channel — turning AI assistants into control and exfiltration tools. buff.ly/4ay9Kvz #AIsecurity #CyberSecurity #AppSec #ThreatIntel 🧵1/3

What breaches orgs say: “it was a highly skilled attack by an advanced threat” What actually happened: www.pcgamer.com/software/sec...

☔️ #LastWeekInAppSec: Two major regressions hit key #DevOps tools this week — both with real potential for impact in enterprise environments. 🔗 buff.ly/REjgAW4 🧵1/4

Seen the news about #PhantomRaven, the NPM malware campaign? Good news: Our Malicious Package Identification API already identifies relevant packages as malicious (see image for one example), and our Malicious Package Protection component has been flagging them during SCA scans. 🧵1/2

🚨 A CVSSv3=10.0 #Vulnerability 🚨 in #DNN (Formerly DotNetNuke) versions prior to 10.1.1 allows unauthenticated users to upload files, even overwriting website assets and other critical components. This is a "the front door is unlocked" situation CVE-2025-64095 -- buff.ly/UdKZLPl 🧵1/3

#Vulnerability alert: Python's `langgraph‑checkpoint‑sqlite` version 2.0.10 — a component of the #langchain #AI project — is vulnerable to SQL injection in filter operators ($eq, $ne, $gt, $lt, $gte, $lte) due to unsafe string concatenation. Update to version 2.0.11 buff.ly/AjRM91E

#Vulnerability: A path traversal in #ApacheTomcat (CVE-2025-55752, #CVSS v3=7.5) allows attackers to gain access to protected URLs including `/WEB-INF/` and `/META-INF/` paths. If PUT method is enabled, this issue could in some cases lead to remote command execution buff.ly/xpnvts6

🗞️ This week in #AppSec: a batch of fresh vulnerabilities you may have missed — including multiple high-impact issues in #GitLab and a serious #CSRF flaw in #ApacheGeode. Full details, fixes, and detection tips 👉 buff.ly/slk16bD #ApplicationSecurity #Infosec #CyberSecurity #DevSecOps 🧵1/7

🥷 If you’re using #dotNET Core’s web server components, know about CVE-2025-55315 — an HTTP Request Smuggling vulnerability rated #CVSS 9.9. Severity depends on how your apps handle requests, so calculate your environmental score carefully. buff.ly/QHRV8ht 🧵1/5

The #Magento / #AdobeECommerce vulnerability known as #SessionReaper (CVE-2025-54236) is being actively exploited, with ThreatRadar reporting that over 250 #eCommerce stores have been compromised via this vector. buff.ly/h695yjT

Ready for a new Branded Vulnerability™? #TARmageddon (CVE-2025-62518) affects the #Rust ecosystem's may forks of `async-tar`; it's a parsing bug for the .tar file format that allows all kinds of shenanigans: at worst even #RCE (Remote Code Execution). #CyberSecurity #SupplyChainSecurity #SCA

It's #LastWeekInAppSec time! Access control bypasses in #Python's #Authlib (#OAuth and #OpenID) and Java's #SpringFramework (#CSRF protection failure). See buff.ly/ZUloV61 for deeper analysis, mitigation steps, etc. #AppSec #VulnManagement #CyberSecurity #SupplyChainSecurity

🚨 High-severity vulnerability in #Strapi (CVE-2024-56143) allows attackers to access private fields – including admin passwords and reset tokens. This can lead to full instance compromise if your API is exposed. If you're using 5.x versions, update to 5.5.2 or later.

It's #LastWeekInAppSec time again! A use-after-free in #Poppler, a #PDF rendering library; and an IDOR in a Liferay web portal that leaks #PII. Summary below, details at buff.ly/hgQ32r9 #AppSec #CyberSecurity #SupplyChainSecurity #OpenSourceSecurity #OpenSource #CVE #Vulnerability