cve

2 articles · newest first

a hacker tweeted a map-server bug tuesday morning. by wednesday, attackers were already inside

GeoServer's jsonArrayContains function scored a 9.8, needed zero credentials, and WatchTowr watched the exploitation start within hours of the tweet that disclosed it.

Aliteq Team · Aug 17, 2026 · 6 min

A terminal window showing npm package install output, representing the compromised JavaScript package ecosystem

Software

a hacked github account just turned npm into a credential-stealing worm

One compromised maintainer account, ten trojanized packages, two billion downloads a month — and the malware is specifically hunting for your Claude and Cursor configs.

Aliteq Team · Aug 9, 2026 · 6 min