31.10.2025

CSO Online 31.10.2025 00:42
Threat actors are finding new ways to insert invisible code or links into open source code to evade detection of software supply chain attacks.
The latest example was found by researchers at Israel-based Koi Security, who this week said they have discovered a threat actor’s campaign that has been running since August, contaminating 126 packages in Microsoft’s npm open source code repository. There have been more than a combined 86,000 installs of these infected packages, and the campaign is continuing.

The Hacker News 30.10.2025 14:45
A severe vulnerability disclosed in Chromium's Blink rendering engine can be exploited to crash many Chromium-based browsers within a few seconds.
Security researcher Jose Pino, who disclosed details of the flaw, has codenamed it Brash.
"It allows any Chromium browser to collapse in 15-60 seconds by exploiting an architectural flaw in how certain DOM operations are managed," Pino said in a

Heise Security 30.10.2025 13:20
Aktuelle Versionen der Monitoring-Software Checkmk schließen eine als kritisches Risiko eingestufte Cross-Site-Scripting-Lücke.

Golem 30.10.2025 11:30
Eine bisher ungepatchte Sicherheitslücke betrifft Nutzer Chromium-basierter Browser. Die Software lässt sich sekundenschnell zum Absturz bringen. (Sicherheitslücke, Google)

Heise Security 30.10.2025 11:20
Ein Patch schließt eine Schwachstelle in der Dateiübertragungssoftware MOVEit Transfer.

Heise Security 30.10.2025 09:10
Die GIMP-Version 3.0.6 schließt einige hochriskante Sicherheitslücken. Angreifer können mit präparierten Bildern Malware einschleusen.