ScanForge Security Digest 2628-02

Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install The Hacker News

The jscrambler npm package was compromised, and simply installing its 8.14.0 release runs an infostealer on yo

Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns The Hacker News

Cybersecurity researchers have disclosed details of sustained cyber espionage activity against several Pakistani law enf

Ghost Accounts Abuse GitHub API in Mass Recon Campaign SecurityWeek

Multiple campaigns are using ghost accounts to map GitHub organizations, including their repositories and members. The p

Australia warns of global campaign targeting vulnerable CMS platforms Bleeping Computer

The Australian Cyber Security Centre (ACSC) issued an alert about a global exploitation campaign targeting vulnerable co

'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets Bleeping Computer

A PNG hiding a prompt injection could steal your repo's secrets, researchers demonstrate. The technique, dubbed 'Ghostco

Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions The Hacker News

Zimbra is urging customers to apply updates to address a critical security vulnerability impacting the Classic Web Clien

New U-Boot flaws could enable stealthy firmware attacks Bleeping Computer

Six vulnerabilities in the widely used U-Boot bootloader have been discovered that could allow attackers to execute mali

Friday Squid Blogging: “Squidbleed” Vulnerability Schneier on Security

In a rare combined cybersecurity/squid post, a twenty-nine-year-old squid proxy bug can leak HTTP requests. As usual, yo