Wireshark 4.6.7 has been released, addressing 12 vulnerabilities and 16 bugs. For security teams, the update matters because network capture tooling is often deployed widely on analyst workstations and troubleshooting systems—making patch hygiene critical. Organizations should verify they’re rolling out the new version and reassess any long-running instances for exposure windows.
Source: SANS ISC
CISA Adds iCagenda and Balbooa Forms Flaws to the Known Exploited Vulnerabilities (KEV) Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added new entries to its KEV catalog, including iCagenda (a Joomla event management extension) and Balbooa Forms. KEV listings are a strong signal that exploitation is either ongoing or highly likely, triggering compliance-driven remediation expectations for federal entities and practical urgency for private sector teams. Teams running Joomla and related extensions should prioritize review of exposure and patch status immediately.
Source: Security Affairs
Critical U-Boot Bugs Undermine Secure Boot: Code Execution During Boot Verification
Binarly disclosed six U-Boot vulnerabilities, including two that can enable code execution during boot image verification. Because U-Boot is embedded across a large portion of internet-connected devices, the potential impact spans home routers, cameras, and server-management hardware—raising the risk of supply-chain-like persistence at the firmware/bootloader layer. Remediation typically requires careful firmware updates and verification, not just OS patching.
Source: Security Affairs
“Slopsquatting” Emerges as an AI-Coding Supply-Chain Threat Powered by Hallucinations
A new supply-chain attack concept—slopsquatting—targets developers using AI coding assistants. Instead of traditional typosquatting, attackers register plausible-looking (often hallucinated) package names that AI tools recommend, then deliver malicious code via installs. The core risk is that the development workflow’s trust in AI output can bypass existing registry defenses, allowing malicious dependencies to persist for months.
Source: VentureBeat
Compromised jscrambler 8.14.0 npm Package: Malicious Preinstall Hook Drops Rust Infostealer
A malicious npm release of jscrambler 8.14.0 shipped with a compromised preinstall hook that drops and executes a native Rust infostealer during installation. The malware runs without needing imports or any follow-on command—meaning a simple install can be sufficient for compromise across Windows, macOS, and Linux. This is a clear reminder to verify package provenance, pin dependencies, and monitor installs in CI/CD and developer environments.
Source: The Hacker News
Ghost Accounts Abuse GitHub API for Large-Scale Recon of Organizations and Repositories
SecurityWeek reports multiple reconnaissance campaigns using “ghost accounts” to map GitHub organizations, including repositories and members. This activity highlights how automated profiling and entitlement discovery can be performed at scale even when code hosting is “legitimate” by design. Organizations should strengthen GitHub monitoring, review unusual API patterns, and ensure access controls and logging are tuned for reconnaissance signals.
Source: Security Week
You May Also Be Interested In...
Week in review: Accenture data breach, plus notable open-source security coverage
AI found a “root bug” in Linux that reportedly went unnoticed for 15 years
Slopsquatting: the AI-coding supply-chain threat replacing typosquatting