Know what changed. Know what matters.

A critical flaw in Metabase’s business intelligence platform lets attackers inject arbitrary SQL and gain full admin control without authentication.

A new campaign has pushed almost 800 malicious npm packages into the registry, all of which ship cross-platform malware that installs a remote access trojan and steals sensitive data across Windows, macOS, and Linux systems.

A long‑standing use‑after‑free bug in Linux's SCTP networking code now allows local users to gain full root privileges on the host and break out of containers.

A newly discovered Linux kernel flaw lets privileged code inside a nested virtual machine escape isolation and run on its host.

A new Senate report attributes more than $20 billion in consumer losses to data‑broker practices that enable sophisticated scams.

A zero‑auth flaw in Gitea’s Org-mode rendering lets attackers read server files.

A credential‑stealing npm worm linked to keyv@6.0.0 infected at least 868 packages, planting AI‑generated malicious hooks in August.

cPanel has released a patch for an SQL injection flaw that let authenticated customers execute commands as the database’s root user.

Malware can hijack Google Password Manager passkeys on Windows machines, bypassing biometric authentication.

A critical vulnerability in Adobe’s marketing platform allows attackers to execute arbitrary code on affected servers.

An Adform‑served JavaScript file rewrote cryptocurrency wallet addresses on July 27, exposing users to potential phishing.