News Archives

Self-Propagating Supply-Chain Worm Compromises npm Packages to Harvest Developer Tokens

Researchers uncovered a self-spreading supply-chain worm that hijacks npm packages, steals developer tokens and secrets, and pushes poisoned releases. The campaign, tracked as CanisterSprawl, also includes PyPI propagation and links to other recent attacks on open-source package registries.

April 23, 2026

Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug

Microsoft issued an out-of-band fix for CVE-2026-40372, a high-severity ASP.NET Core vulnerability that can enable privilege escalation on non-Windows hosts. Upgrade guidance and mitigation steps explained.

April 22, 2026

CISA Adds Eight Actively Exploited Flaws to KEV, Orders Federal Patching by April–May 2026

CISA has added eight actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including three affecting Cisco Catalyst SD-WAN Manager, and set federal remediation deadlines in April and May 2026.

April 21, 2026

Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials

Vercel says a compromise of Context.ai led to unauthorized access to some internal systems and a limited set of customer credentials; Vercel is working with Mandiant and others while investigating exfiltration and rolling out new dashboard security features.

April 20, 2026

Sanctioned Grinex Exchange Halts Operations After $13.74M Breach It Blames on Western Intelligence

Grinex, a Kyrgyzstan-registered crypto exchange under U.K. and U.S. sanctions, has paused services after reporting a $13.74M theft it attributes to Western intelligence. Blockchain firms and the U.S. Treasury trace links to the sanctioned Garantex, rapid token swaps, and a broader network allegedly used to dodge sanctions.

April 19, 2026

NIST narrows CVE enrichment after 263% surge in submissions

NIST will only enrich CVEs that meet new prioritization criteria after a 263% increase in submissions between 2020 and 2025. The change, effective April 15, 2026, narrows enrichment to CISA KEV entries, federal software, and critical software defined by EO 14028; other CVEs will be marked

April 18, 2026