CVE-2026-48907 in the Joomla JCE plugin lets unauthenticated attackers drop PHP web shells with a single crafted request.

Microsoft Threat Intelligence analyzed a cryptocurrency clipper campaign that combines clipboard theft, wallet replacement, ...

Threat actors are exploiting vulnerabilities in Joomla and the LiteSpeed cPanel plugin for code execution and privilege ...

Three popular plugins served malicious JavaScript through a compromised CDN.

The acquisition will unify VoidZero’s high-performance tooling — including the Vite build tool, Vitest test runner, Rust-based Rolldown bundler and Oxc toolchain — natively into the Cloudflare ...

Ghost CMS flaw CVE-2026-26980 enabled attacks on 700+ sites, injecting ClickFix malware through fake CAPTCHA pages.

The Hacker News is the top cybersecurity news platform, delivering real-time updates, threat intelligence, data breach ...

Community driven content discussing all aspects of software development from DevOps to design patterns. Note, this article deals with client-side JavaScript. For a client and server-side JavaScript ...

Wordfence researchers uncover a new piece of WordPress malware Threat actors used AI to create legitimate-looking tools The malware pretends to be an anti-malware product Security researchers have ...

Since October 2024, Microsoft Defender Experts (DEX) has observed and helped multiple customers address campaigns leveraging Node.js to deliver malware and other payloads that ultimately lead to ...