MALFEX: Eight Malicious npm Packages, 40,767 Downloads, and an ASCII Art Font That Drops a RAT
A lone, Portuguese-speaking operator has been seeding npm with malware since 2023, and three of the eight flagged packages are reportedly still live. Here's how the MALFEX campaign works and what I'd check in my own projects today.
Rebuilding an Akira Ransomware Attack Without EDR: What Huntress Found in the Leftovers
Huntress deployed its agent after Akira ransomware had already hit a victim, then reconstructed the attack from event logs, Registry artefacts and the ransomware's own log files. Here's what they found and what I'd take from it.
SonicWall SMA 1000 SSRF (CVE-2026-102255) Is Already Being Exploited: Patch Now, Then Assume the Worst
Attackers began probing a CVSS 10.0 pre-auth SSRF in SonicWall SMA 1000 appliances two days after patches shipped. Here's what's known, why this product keeps getting hit, and what I'd do if I ran one.
GitLab Warns of a Max-Severity Code Execution Flaw in Its CI/CD Regex Compiler
GitLab is urging users to patch a maximum-severity flaw in its CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code. Here's what's known, what isn't, and what I'd do right now if I ran a GitLab instance.
The Account That Owned Every Page
Adding XWiki to the homelab cluster with Authentik single sign-on: three chart failures, an encrypted token that blamed JSON, and the ownership change that broke 1,582 pages at once.