Source
6 articles citing this source
Reporting on the Brotli decoder flaw CVE-2026-111497 shows fixes, scanner coverage and exploitation status differing across Node.js, .NET, Python packages and others.
LiteLLM 1.107.0 on PyPI and Docker carried a credential stealer and backdoor; the project says attackers used stolen GitHub CLI tokens and a lookalike repository to publish it.
JFrog's October 7 advisory rates LMCache's CVE-2026-105192 at CVSS 9.8 and lists no fixed release; a fix pull request opened October 11 was still open that day.
SQLite's own CVE tracker and the National Vulnerability Database both rejected six reports as AI-hallucinated after a JFrog researcher found the underlying code and PoCs didn't exist or didn't work.
Microsoft attributes the June 17 compromise of 140-plus Mastra npm packages to North Korean state actor Sapphire Sleet, which used a hijacked maintainer account to inject a malicious dayjs typosquat called easy-day-js.
JFrog disclosed IronWorm, a self-propagating npm worm written in Rust that uses an eBPF rootkit, Tor command-and-control, and stolen credentials to spread.