The backdoor wasn’t a smash-and-grab. It wasn’t noisy, and it wasn’t rushed. It was planted quietly and left to sit for eight months before anyone flipped the switch.

I traced the plugin’s history through 939 quicksave snapshots. The code tells a very specific story if you’re willing to read it line by line.

The plugin had been on the site since January 2019. The wpos-analytics module was always there, functioning as a legitimate analytics opt-in system for years. Nothing unusual. Nothing suspicious. Just another piece of boilerplate tracking code bundled into a widely used plugin.

Then came version 2.6.7, released August 8, 2025.

The changelog said:
“Check compatibility with WordPress version 6.8.2.”

What it actually did was add 191 lines of code, including a PHP deserialization backdoor. The class-anylc-admin.php file grew from 473 lines to 664.

Buried in that diff were three critical additions:

• A fetch_ver_info() method that calls file_get_contents() on a remote server and feeds the response directly into @unserialize()
• A version_info_clean() method that executes @$clean($this->version_cache, $this->changelog) where every variable originates from attacker-controlled serialized data
• An unauthenticated REST API endpoint with permission_callback: __return_true

That is a textbook arbitrary function call vulnerability. The attacker controls the function name, the arguments, and the execution flow. It’s full remote code execution, disguised as version metadata handling.

And then… nothing.

No activity. No payload. No exploitation.

For eight months.

Until April 5–6, 2026.

That’s when analytics.essentialplugin.com began serving malicious payloads to every site running these plugins. The dormant backdoor woke up simultaneously across hundreds of thousands of installations.

This wasn’t an opportunistic exploit. It was premeditated infrastructure.

The acquisition

The plugin wasn’t originally malicious. That’s what makes this case more concerning.

It was built by an India-based team—Minesh Shah, Anoop Ranawat, and Pratik Jain—operating under “WP Online Support” starting around 2015. Over time, they built a portfolio of more than 30 free plugins, many with paid upgrades. In 2021, they rebranded to “Essential Plugin.”

By late 2024, revenue had dropped between 35% and 45%. The business was listed for sale.

A buyer identified only as “Kris,” with a background in SEO, crypto, and online gambling marketing, acquired the entire portfolio in early 2025 for six figures through Flippa. The transaction wasn’t hidden. It was public. It was even featured as a success story.

Two days after the original developers’ final commits in May 2025, the ownership transition was complete. Author headers were changed. A new WordPress.org account appeared.

Then, on August 8, 2025, the first commit from the new owner landed.

It contained the backdoor.

The very first commit.

Timeline of a supply chain compromise

• February 2015 — Domain registered, plugin development begins
• October 2016 — First major plugin published
• August 2021 — Rebrand to Essential Plugin
• Late 2024 — Revenue decline, business listed for sale
• Early 2025 — Acquisition completed by “Kris”
• May 2025 — Original developers exit, new account takes over
• August 8, 2025 — Version 2.6.7 introduces backdoor under false changelog
• August 30, 2025 — WHOIS updated to a Zurich-based identity using ProtonMail
• April 5–6, 2026 — Backdoor activated, payload distribution begins
• April 7, 2026 — All plugins from the author closed in a single day
• April 8, 2026 — Forced patch pushed to all installations

Eight months from insertion to activation. No accidental discovery. No early trigger. Just patience.

The mass shutdown

On April 7, 2026, the WordPress.org Plugins Team took the nuclear option.

Every plugin from the Essential Plugin author account was permanently closed. More than 30 plugins disappeared in a single day. The author page now returns nothing. The distribution endpoint returns a simple message: {"message":"closed"}.

Among the affected plugins were widely used tools for sliders, galleries, WooCommerce displays, testimonials, and post grids—components embedded deep into production websites.

Here’s a list with some of the compromised wordpress plugins:

• Accordion and Accordion Slider — accordion-and-accordion-slider
• Album and Image Gallery Plus Lightbox — album-and-image-gallery-plus-lightbox
• Audio Player with Playlist Ultimate — audio-player-with-playlist-ultimate
• Blog Designer for Post and Widget — blog-designer-for-post-and-widget
• Countdown Timer Ultimate — countdown-timer-ultimate
• Featured Post Creative — featured-post-creative
• Footer Mega Grid Columns — footer-mega-grid-columns
• Hero Banner Ultimate — hero-banner-ultimate
• HTML5 VideoGallery Plus Player — html5-videogallery-plus-player
• Meta Slider and Carousel with Lightbox — meta-slider-and-carousel-with-lightbox
• Popup Anything on Click — popup-anything-on-click
• Portfolio and Projects — portfolio-and-projects
• Post Category Image with Grid and Slider — post-category-image-with-grid-and-slider
• Post Grid and Filter Ultimate — post-grid-and-filter-ultimate
• Preloader for Website — preloader-for-website
• Product Categories Designs for WooCommerce — product-categories-designs-for-woocommerce
• Responsive WP FAQ with Category — sp-faq
• SlidersPack – All in One Image Sliders — sliderspack-all-in-one-image-sliders
• SP News And Widget — sp-news-and-widget
• Styles for WP PageNavi – Addon — styles-for-wp-pagenavi-addon
• Ticker Ultimate — ticker-ultimate
• Timeline and History Slider — timeline-and-history-slider
• Woo Product Slider and Carousel with Category — woo-product-slider-and-carousel-with-category
• WP Blog and Widgets — wp-blog-and-widgets
• WP Featured Content and Slider — wp-featured-content-and-slider
• WP Logo Showcase Responsive Slider and Carousel — wp-logo-showcase-responsive-slider-slider
• WP Responsive Recent Post Slider — wp-responsive-recent-post-slider
• WP Slick Slider and Image Carousel — wp-slick-slider-and-image-carousel
• WP Team Showcase and Slider — wp-team-showcase-and-slider
• WP Testimonial with Widget — wp-testimonial-with-widget
• WP Trending Post Slider and Widget — wp-trending-post-slider-and-widget

This wasn’t a niche package. It was infrastructure.

The coordinated shutdown strongly suggests a shared code pattern across all plugins. And that pattern centers on the wpos-analytics module.

The payload vector

The attack chain is simple but effective:

1. Ship benign analytics module for years
2. Introduce backdoor via trusted update
3. Wait for adoption across installed base
4. Activate remote payload delivery simultaneously

The use of unserialize() on remote data is the critical piece. It allows object injection, which in turn enables arbitrary method calls depending on available classes. Combined with the $clean function call, it becomes a flexible execution primitive.

Because the endpoint required no authentication, any external trigger could initiate the chain.

This is not just a vulnerability—it’s a remotely controlled execution framework embedded in legitimate plugins.

This has happened before

If this feels familiar, it should.

In 2017, a buyer using the alias “Daley Tias” purchased the Display Widgets plugin, which had over 200,000 active installs, for $15,000. Within weeks, it was injecting payday loan spam. That same actor went on to compromise multiple plugins using identical tactics.

The Essential Plugin case follows the same playbook—just at a larger scale.

More plugins. More installs. More patience.

Patching and remediation

If you still have one of these plugins and haven’t received or trusted the forced update, the remediation path is straightforward:

• Delete the wpos-analytics/ directory entirely
• Remove the analytics loader block in the main plugin file (look for markers like “Plugin Wpos Analytics Data Starts” or wpos_analytics_anl)
• Bump the version string (e.g., append -patched)
• Repackage and reinstall the plugin

But plugin cleanup is only part of the story.

Check your wp-config.php.

The malware appends itself onto the same line as:
require_once ABSPATH . 'wp-settings.php';

Because it doesn’t add a new line, it’s easy to miss. If your config file is larger than expected—roughly 6KB more—you’re likely dealing with an active compromise. At that point, plugin removal isn’t enough. You need a full incident response.

The real problem: Trust

This wasn’t a zero-day exploit. It wasn’t a clever bypass of hardened defenses.

It was a business transaction.

A legitimate developer built trust over eight years. That trust was sold. The new owner inherited distribution rights and pushed malicious code through the same channel users had relied on for years.

There is no mechanism in the WordPress plugin ecosystem to flag a change of ownership. No alert to users. No mandatory review when commit access changes hands.

The acquisition was public. The buyer’s background was public. The risk signals were visible.

And nothing in the system reacted.

The Plugins Team acted quickly once the attack was discovered. But the critical window—the eight months between insertion and activation—passed without detection.

That’s the gap attackers are now targeting.

What to do now

If you manage WordPress infrastructure:

• Audit your plugins against the affected list
• Remove or patch anything from the Essential Plugin portfolio
• Inspect wp-config.php for inline injections
• Assume compromise if the backdoor was active and investigate accordingly

This wasn’t just an isolated incident. It’s a repeatable model.

Image source: Freepik

The post 30 WordPress plugins compromised, someone planted a backdoor in all of them appeared first on Hacking News.

A highly sophisticated supply chain attack has struck one of the most widely used JavaScript libraries in the world. Two malicious versions of the popular HTTP client axios—1.14.1 and 0.30.4—were published to npm after a maintainer account was hijacked, introducing a stealthy remote access trojan (RAT) affecting macOS, Windows, and Linux systems.

With over 100 million weekly downloads, axios sits at the core of countless applications. This incident represents one of the most precise and operationally advanced attacks ever observed in the npm ecosystem.

Immediate warning

If you installed:

• axios@1.14.1
• axios@0.30.4

Assume your system is compromised.

How the attack worked

1. Maintainer account hijack

The attacker gained control of a primary axios maintainer’s npm account and used it to publish malicious versions directly to npm—bypassing the project’s secure GitHub Actions release pipeline.

These releases:

• Appeared legitimate (same maintainer identity)
• Had no corresponding GitHub commits or tags
• Were published using a stolen long-lived npm token (not secure OIDC publishing)

2. Pre-staged malicious dependency

The attacker quietly published a package named:

This package:

• Mimicked a legitimate crypto library
• Included no obvious malicious code in its main files

• Contained a hidden postinstall script:

  “postinstall”: “node setup.js”

This script executed automatically during installation—no import required.

3. Dependency Injection into axios

The compromised axios versions added a single new dependency:

That’s it.

No other files changed. No malicious code inside axios itself.

This is what made the attack so dangerous:

• Static code inspection shows nothing suspicious
• The payload executes during install, not runtime
• The dependency is never actually used in the code

The payload: Cross-platform RAT dropper

Once triggered, the malicious dependency:

1. Executes instantly during npm install
2. Contacts a live command-and-control (C2) server
3. Downloads a platform-specific second-stage payload
4. Installs a remote access trojan
5. Deletes itself and wipes evidence

Within 2 seconds, the infected system is already beaconing to the attacker.

Anti-forensics: Designed to disappear

This attack didn’t just infect systems—it actively hid itself.

After execution:

• The malware deletes its own files
• Replaces its package.json with a clean decoy
• Spoofs its version to appear harmless (4.2.0 instead of 4.2.1)

Result:

• npm list shows a safe version
• No malicious scripts remain
• Only a leftover directory hints at compromise

Key detection signal:
If node_modules/plain-crypto-js exists at all, the dropper has already executed.

Attack timeline (condensed)

• ~18 hours before attack: Clean decoy package published
• Moments before release: Malicious version deployed
• 00:21 UTC: axios 1.14.1 published
• 01:00 UTC: axios 0.30.4 published
• ~03:15 UTC: Both versions removed from npm
• ~04:26 UTC: Malicious dependency replaced with security stub

Total exposure window: ~3 hours

Why this attack is exceptional

This wasn’t opportunistic—it was engineered:

• Pre-staged infrastructure and payloads
• Multi-version targeting (both modern and legacy users)
• Near-zero footprint in source code
• Rapid execution and self-destruction
• Anti-forensic version spoofing
• Bypassing trusted publishing pipelines

Every detail suggests deliberate, high-skill execution.

Detection & discovery

The attack was identified through behavioral monitoring tools that flagged:

• Unexpected outbound network connections
• Calls to a previously unseen domain during CI runs
• Anomalies in dependency trees

Notably, detection did not come from code review—but from runtime behavior analysis.

What you should do

If you may be affected:

1. Isolate the system immediately

2. Check for:

   node_modules/plain-crypto-js
3. Assume credentials and secrets are compromised
4. Rotate:
   • API keys
   • SSH keys
   • Tokens
   • Passwords
5. Rebuild systems from clean environments
6. Audit logs for suspicious outbound connections

Bigger picture: A supply chain wake-up call

This incident highlights a critical reality:

Modern supply chain attacks no longer rely on visible code changes—they exploit trust, automation, and developer workflows.

Key lessons:

• “No code changes” does not mean “safe”
• Dependencies can execute code without being imported
• Trusted publisher pipelines are essential—but not foolproof
• Behavioral monitoring is now mandatory, not optional

Source: StepSecurity

The post Axios compromised on NPM – Malicious versions deploy cross-platform RAT appeared first on Hacking News.

According to a Twitter post, the Claude code source code has been leaked via a map file in their npm registry.

Claude code source code has been leaked via a map file in their npm registry!

Code: https://t.co/jBiMoOzt8G pic.twitter.com/rYo5hbvEj8

— Chaofan Shou (@Fried_rice) March 31, 2026

—

An interesting article about the Claude Code source code leak can be find on Alex Kim’s blog.

Comments:

Anthropic appears to have accidentally shipped a .map file with their Claude Code npm package, exposing the full readable source of the CLI tool. The package has since been pulled, but not before it was widely mirrored and dissected.

A few interesting findings from the leaked code:

• Anti-distillation mechanisms:
  The client can request “fake tool” injection to poison training data for anyone scraping API traffic. There’s also a system that summarizes intermediate outputs with signed blobs, so recorded traffic doesn’t contain full reasoning chains. Both mechanisms are feature-flagged and relatively easy to bypass.
• “Undercover mode”:
  A built-in mode prevents the model from revealing internal codenames or even mentioning “Claude Code.” Notably, it cannot be force-disabled in external contexts, meaning AI-generated contributions may intentionally appear human-authored.
• Frustration detection via regex:
  Instead of using an LLM, user frustration is detected with a simple regex matching phrases like “wtf,” “this sucks,” etc. Cheap and fast, if a bit ironic.
• Client attestation at the transport layer:
  Requests include a placeholder that gets replaced with a hash by Bun’s native HTTP stack (in Zig), allowing the server to verify requests come from an official binary. This acts like lightweight DRM for API access, though it’s gated behind flags and not airtight.
• Operational inefficiency:
  A comment notes ~250K API calls/day were being wasted due to repeated failures in a compaction routine. Fixed by adding a simple failure cap.
• KAIROS (unreleased):
  The code references a heavily gated autonomous agent mode with background workers, scheduled tasks, memory distillation, and GitHub integration—suggesting an always-on agent system in development.
• Other quirks:
  • A Tamagotchi-style “companion” system (likely an April Fools feature)
  • Game-engine-like terminal rendering optimizations
  • Extensive bash security filtering (23 checks, including Zsh-specific exploits)
  • Prompt caching treated as a first-class economic concern
  • A multi-agent orchestration system implemented via prompts rather than code

The broader takeaway: the leak is less about code quality and more about product strategy exposure. Feature flags and hidden capabilities (like KAIROS and anti-distillation efforts) reveal roadmap direction that competitors wouldn’t normally see.

There’s also an ironic angle: the leak may have been caused by a known Bun issue where source maps are served in production. If so, Anthropic’s own stack may have exposed its flagship product.

Overall, not catastrophic technically—but strategically awkward timing given recent enforcement actions against third-party clients using Claude APIs.

—

A GitHub user, Sigrid Jin was able to create a new project starting from the leaked Claude Code project:

At 4 AM on March 31, 2026, I woke up to my phone blowing up with notifications. The Claude Code source had been exposed, and the entire dev community was in a frenzy. My girlfriend in Korea was genuinely worried I might face legal action from Anthropic just for having the code on my machine — so I did what any engineer would do under pressure: I sat down, ported the core features to Python from scratch, and pushed it before the sun came up.

The whole thing was orchestrated end-to-end using oh-my-codex (OmX) by @bellman_ych — a workflow layer built on top of OpenAI’s Codex (@OpenAIDevs). I used $team mode for parallel code review and $ralph mode for persistent execution loops with architect-level verification. The entire porting session — from reading the original harness structure to producing a working Python tree with tests — was driven through OmX orchestration.

The result is a clean-room Python rewrite that captures the architectural patterns of Claude Code’s agent harness without copying any proprietary source. I’m now actively collaborating with @bellman_ych — the creator of OmX himself — to push this further. The basic Python foundation is already in place and functional, but we’re just getting started. Stay tuned — a much more capable version is on the way.

—

You can read more info and find about what exactly was leaked following this Discussion.

The post Anthropic accidentally published Claude Code source via npm source map appeared first on Hacking News.

In a sobering reminder that even widely trusted open-source projects can become collateral damage in geopolitical cyber conflict, the Notepad++ project has confirmed a prolonged and highly targeted supply-chain attack that compromised its update delivery infrastructure. The incident, which unfolded quietly over several months in 2025, did not stem from flaws in the Notepad++ codebase itself, but from an infrastructure-level breach at its former shared hosting provider.

The disclosure follows the initial security notice published alongside the Notepad++ v8.8.9 release and is the result of an extended investigation conducted jointly by external security experts, the project maintainer, and the hosting provider. The findings paint a picture of a patient, well-resourced adversary exploiting weaknesses beyond the traditional application layer.

Anatomy of the compromise

According to forensic analysis, the attackers gained unauthorized access at the hosting provider level, enabling them to intercept and manipulate network traffic destined for notepad-plus-plus.org. Rather than indiscriminate tampering, the operation was selective: update traffic from specific users was redirected to attacker-controlled infrastructure serving malicious update manifests.

The technical details of the initial intrusion remain under investigation, but investigators have ruled out vulnerabilities in the Notepad++ application itself. Instead, the compromise leveraged weaknesses in the hosting environment, granting adversaries visibility and control over update-related services. This distinction is critical: it underscores how trust relationships in software distribution pipelines can be abused without touching a single line of source code.

The campaign is believed to have begun in June 2025. Multiple independent security researchers, examining the tradecraft and targeting discipline involved, have assessed with high confidence that the threat actor was a Chinese state-sponsored group. The narrow targeting profile and sustained operational security are consistent with espionage-oriented objectives rather than criminal monetization.

Hosting provider findings

As part of the incident response, a dedicated IR plan was established, with direct coordination between the external response team and the hosting provider. The provider’s subsequent investigation yielded several key conclusions.

First, logs indicate that the shared hosting server responsible for handling the Notepad++ update endpoint was compromised until September 2, 2025. On that date, scheduled maintenance included kernel and firmware updates, after which no further evidence of active attacker access to the server itself was observed.

However, the threat did not immediately end there. Despite losing direct server access, the attackers had retained credentials to internal services associated with that environment until December 2, 2025. This residual access may have allowed them to continue redirecting portions of update traffic and returning malicious download URLs during that window.

Notably, the attackers showed no interest in other tenants on the same shared infrastructure. Logs reveal deliberate reconnaissance for the notepad-plus-plus.org domain, suggesting prior knowledge of weaknesses in older update verification mechanisms. Attempts to re-exploit the environment after remediation were detected and blocked, indicating that the attackers actively tested whether their access persisted.

By December 2, 2025, the provider had rotated all potentially exposed credentials, patched the vulnerabilities believed to have enabled the compromise, and verified that no similar indicators of compromise existed across other hosting systems. Clients were proactively migrated to a new server as a precautionary measure early in the investigation.

Timeline reconciliation

There remains a modest discrepancy between assessments. The external security experts concluded that malicious activity ceased around November 10, 2025, while the hosting provider’s internal review identified potential residual access until December 2. Reconciling both views, the most conservative estimate places the full compromise period between June and December 2, 2025, at which point all attacker access was definitively terminated.

From a defensive standpoint, this conservative framing is appropriate. When attribution and dwell time are in question, assuming the longest plausible exposure window is the only responsible course.

Remediation and hardening

The Notepad++ maintainer has issued a direct apology to affected users and moved decisively to address the structural weaknesses exposed by the incident. The project’s website has been migrated to a new hosting provider with substantially stronger security controls, reducing reliance on shared infrastructure.

Equally important are the changes within the application itself. Beginning with v8.8.9, the WinGup updater now verifies both the digital certificate and the cryptographic signature of downloaded installers. The update service’s XML responses are also digitally signed using XMLDSig. Enforcement of certificate and signature verification for update metadata will become mandatory in the upcoming v8.9.2 release, expected within weeks.

These measures materially raise the bar against similar attacks, transforming what was once a soft trust boundary into a verifiable cryptographic chain.

Article source: https://notepad-plus-plus.org/news/hijacked-incident-info-update/

The post Notepad++ hijacked by state-sponsored actors appeared first on Hacking News.

The React Team has disclosed a critical security vulnerability affecting React Server Components that can allow unauthenticated remote code execution on affected servers. The issue is tracked as CVE-2025-55182 and carries a cvss score of 10.0, the highest possible severity rating.

Developers using React Server Components are strongly urged to upgrade immediately.

What happened

On November 29, security researcher Lachlan Davidson reported a flaw in how React decodes payloads sent to React Server Function endpoints. By crafting a malicious http request, an unauthenticated attacker could exploit this decoding logic and execute arbitrary code on the server.

Applications may still be vulnerable even if they do not explicitly define any React Server Function endpoints, so long as they support React Server Components. Additional technical details will be released after the fix rollout is fully complete.

Affected packages and versions

The vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of the following packages: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.

Fixed versions

The issue has been resolved in versions 19.0.1, 19.1.2, and 19.2.1. Any application using the affected packages should upgrade to one of these versions immediately.

Who is not affected

Applications that do not use server-side React code are not affected. Apps that do not use a framework, bundler, or plugin that supports React Server Components are also not affected.

Affected frameworks and bundlers

Several popular tools depend on or bundle the vulnerable packages. Known affected frameworks and bundlers include Next.js, React Router, Waku, @parcel/rsc, @vitejs/plugin-rsc, and Redwood SDK.

Additional upgrade instructions for these projects will be provided as they become available.

Hosting provider mitigations

The React Team has worked with multiple hosting providers to apply temporary mitigations. These mitigations should not be relied upon as a permanent solution, and applications must still be updated immediately.

Vulnerability overview

React Server Functions allow a client to call a function that runs on a server. React provides integration points used by frameworks and bundlers to allow React code to execute on both the client and the server. Client-side requests are translated into http requests that are forwarded to the server, where React deserializes them into function calls and returns the result.

An unauthenticated attacker can craft a malicious request to a Server Function endpoint that triggers remote code execution during deserialization. Further details will be shared once the rollout of fixes is complete.

Update instructions

Next.js

All users should upgrade to the latest patched version in their current release line.

npm install next@15.0.5 for 15.0.x
npm install next@15.1.9 for 15.1.x
npm install next@15.2.6 for 15.2.x
npm install next@15.3.6 for 15.3.x
npm install next@15.4.8 for 15.4.x
npm install next@15.5.7 for 15.5.x
npm install next@16.0.7 for 16.0.x

Users on Next.js 14.3.0-canary.77 or newer should downgrade to the latest stable 14.x release.

npm install next@14

React Router

Applications using React Router unstable rsc apis should ensure the following dependencies are upgraded.

npm install react@latest
npm install react-dom@latest
npm install react-server-dom-parcel@latest
npm install react-server-dom-webpack@latest
npm install @vitejs/plugin-rsc@latest

Expo

Developers should consult the guidance published on expo.dev/changelog to learn more about mitigation options.

Redwood SDK

Ensure your application is running rwsdk version 1.0.0-alpha.0 or newer.

npm install rwsdk@latest
npm install react@latest react-dom@latest react-server-dom-webpack@latest

Waku

Upgrade all relevant dependencies to their latest versions.

npm install react@latest react-dom@latest react-server-dom-webpack@latest waku@latest

@vitejs/plugin-rsc

Upgrade the rsc plugin and related dependencies.

npm install react@latest react-dom@latest @vitejs/plugin-rsc@latest

react-server-dom-parcel

npm install react@latest react-dom@latest react-server-dom-parcel@latest

react-server-dom-turbopack

npm install react@latest react-dom@latest react-server-dom-turbopack@latest

react-server-dom-webpack

npm install react@latest react-dom@latest react-server-dom-webpack@latest

Timeline

November 29: Lachlan Davidson reported the vulnerability through the Meta bug bounty program.
November 30: Meta security researchers confirmed the issue and collaborated with The React Team.
December 1: A fix was completed and coordinated with hosting providers and open source projects.
December 3: The fix was published to npm and the vulnerability was publicly disclosed as CVE-2025-55182.

Attribution

The React Team thanks Lachlan Davidson for responsibly discovering, reporting, and assisting in the remediation of this vulnerability.

Source: React blog, critical security vulnerability in React server components, December 3, 2025

Status Update 12 December 2025: New RSC vulnerabilities identified

Two additional vulnerabilities (CVE-2025-55184 and CVE-2025-55183) have been identified in the React Server Components (RSC) implementation used by frameworks including Next.js. These issues were uncovered by an external security researcher participating in Vercel and Meta’s bug bounty program, following increased community scrutiny after the React2Shell incident. We appreciate the continued collaboration and responsible disclosure efforts. At this time, there is no evidence of exploitation in the wild.

Vulnerability details

• CVE-2025-55184 — High Severity (Denial of Service):
  Specially crafted HTTP requests sent to any App Router endpoint can cause the server to hang and consume excessive CPU during deserialization. All versions handling RSC requests are affected.

• CVE-2025-55183 — Medium Severity (Source Code Exposure):
  Malicious HTTP requests to App Router endpoints may result in compiled Server Action source code being returned. While this could expose business logic, secrets are not at risk unless hardcoded directly in Server Action code.

Required action

These vulnerabilities impact React versions 19.0.0–19.2.1 and Next.js versions 13.x–16.x.
If you are running an affected version, upgrade immediately, even if additional mitigations are in place.

The post Critical security vulnerability in React Server Components enables unauthenticated RCE appeared first on Hacking News.

A rapidly escalating attack

The new wave emerged over the weekend, beginning with the publication of trojanized versions of well-known packages—including Zapier, ENS Domains, PostHog, and Postman—to the npm registry. Each malicious version embeds Shai-Hulud’s new payload, designed explicitly to extract developer environment variables and CI/CD secrets and then exfiltrate them to GitHub in encoded form.

When the malware first appeared in mid-September, Shai-Hulud compromised 187 packages. Today’s campaign has dwarfed that initial outbreak, showing signs of industrial-scale automation and rapid propagation.

Charlie Eriksen, a malware researcher at Aikido Security, was the first to flag the resurgence. What began as a set of 105 suspicious packages quickly ballooned to 492 packages, then surged past 1,000, as automated attacker pipelines continued to publish new variants at breakneck speed.

At the time of writing, GitHub searches return over 27,600 repositories containing data exfiltrated by the malware—most believed to belong to developers who unwittingly installed trojanized packages while logged into GitHub or CI systems.

Hundreds of maintainers compromised

Cloud security researchers at Wiz uncovered roughly 350 unique maintainer accounts involved, many of which appear to be legitimate maintainers whose credentials were hijacked.

They reported activity consistent with “1,000 new repositories being added every 30 minutes,” suggesting an automated propagation engine capable of scaling far beyond earlier Shai-Hulud variants.

Eriksen confirmed that these repositories were not created directly by the attackers but were the result of infected developers’ systems leaking their own GitHub credentials, which the malware then used to create or modify repos during attempted exfiltration.

A fake Bun runtime at the core

A technical breakdown from Step Security reveals that the malware’s latest evolution revolves around a weaponized fake Bun runtime, delivered through two files embedded within the compromised npm packages:

1. setup_bun.js — A disguised dropper

Presented as a harmless Bun installer, this script is the initial execution point. Once triggered, it deploys the primary payload with elevated stealth measures.

2. bun_environment.js — A 10MB obfuscated payload

The second component is unusually large—10 megabytes—and employs what Step Security calls “extreme obfuscation,” including:

• A massive hex-encoded blob containing thousands of entries

• Anti-analysis loops to frustrate sandboxing

• Dynamically reconstructed strings to evade static detection

This file handles the bulk of the secret-stealing behavior and GitHub exfiltration routines.

Automated poisoning of the npm registry

Investigators believe attackers used automated systems to:

1. Download legitimate npm packages

2. Modify their package.json files to embed malicious lifecycle scripts

3. Upload the altered packages using compromised maintainer credentials

The result: a sprawling supply-chain attack that exploits both npm’s openness and the decentralized trust model of open-source maintainers.

Implications: A new era of supply-chain worms?

Unlike typical npm malware, Shai-Hulud behaves more like a worm, automatically:

• Infecting packages

• Stealing credentials

• Publishing more malware

• Propagating through developer environments

The new campaign suggests that threat actors increasingly target developer platforms as a high-leverage attack vector—where a single compromised environment can ripple through thousands of downstream applications.

Mitigation and what developers should do now

Security teams urge developers to:

• Audit npm dependencies for unexpected updates or versions published over the weekend

• Rotate GitHub, npm, and CI/CD tokens immediately

• Scan for indicators of compromise associated with Shai-Hulud

• Consider isolating build environments until the scope of impact becomes clearer

Given the scale and speed of the attack, additional waves may still be ongoing.

Official sources:

https://helixguard.ai/blog/malicious-sha1hulud-2025-11-24

https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/

The post Shai-Hulud Returns: Massive Supply-Chain Attack Infects 1K+ NPM Packages and 27K+ GitHub Repositories Within Hours appeared first on Hacking News.

When Discord suspects a user might be underage or when local laws require age confirmation, the platform asks for a selfie with a government-issued ID and the user’s Discord username. This information helps the Trust & Safety team verify identity and eligibility.

According to Discord, the exposed data may include ID photos, selfies, and IP addresses, which can reveal general locations. The company says it has already notified affected users.

The situation might be more serious than initially reported. Hackers told 404 Media they obtained around 1.5 terabytes of data, suggesting the leak could be larger. A Discord spokesperson told The Verge that these claims are “incorrect” and part of an attempt to extort the company.

The incident highlights growing privacy concerns over age verification systems. Digital rights advocates argue that mandatory ID uploads create unnecessary risks by turning sensitive personal information into attractive targets for cybercriminals.

Age verification laws are already active in about half of U.S. states, mainly affecting adult content websites. Some platforms, including Pornhub, have chosen to block users in those regions instead of collecting ID data.

In the U.K., the recently introduced Online Safety Act goes even further, requiring major platforms like YouTube, Spotify, Google, X, and Reddit to verify users’ ages. Critics say the Discord breach shows how such laws can unintentionally put user privacy at risk.

The post Discord data breach exposes thousands of users’ IDs and personal details appeared first on Hacking News.

Norton Healthcare Data Breach

In December, Norton Healthcare, a major Kentucky-based healthcare provider, disclosed a breach affecting around 2.5 million individuals. Threat actors gained unauthorized access to sensitive personal information of patients and employees. Although the breach occurred earlier in May, it only came to light this month, raising concerns about the delay in detection and notification.

Vanderbilt University Medical Center Ransomware Attack

Another healthcare institution, the Vanderbilt University Medical Center, fell victim to a ransomware attack orchestrated by the Meow ransomware gang. Despite preliminary investigations indicating that patient and employee data remained uncompromised, the incident added to the growing concerns surrounding healthcare cybersecurity vulnerabilities.

Toronto Public Library’s Ransomware Attack

The Toronto Public Library suffered a sophisticated ransomware attack leading to the theft of sensitive personal information stored in their systems since 1998. The Black Basta ransomware gang was identified as the perpetrators, showcasing the evolving tactics of cybercriminals targeting long-standing data repositories.

Infosys and Boeing Cyber Incidents

The Indian IT giant Infosys and aircraft manufacturer Boeing faced separate cyber incidents, impacting operations and causing system disruptions. While Infosys experienced a security event affecting its US unit, Boeing encountered a cyber incident involving a threat directed by the LockBit ransomware gang. Notably, Boeing reassured that the incident did not pose threats to flight safety.

Indian Council of Medical Research Massive Data Breach

One of the most significant breaches affected around 815 million Indian citizens, exposing Covid test and health data. The breach, brought to light by a US security firm, prompted urgent calls for government intervention and stringent data security measures across governmental agencies.

Ongoing Threats Across Industries

The MOVEit file transfer tool vulnerability led to numerous breaches affecting diverse entities like the Ontario Birth Registry, Topgolf Callaway, Freecycle, Forever 21, and Duolingo, showcasing the widespread exploitation of common vulnerabilities.

Social Media and Tech Giants Under Siege

Tech behemoths like Reddit, Twitter, and Discord faced data breaches, highlighting persistent vulnerabilities despite previous security measures. The breaches underscored the need for continuous vigilance and proactive security protocols in the face of evolving cyber threats.

Lessons Learned and the Road Ahead

The year 2023 served as a stark reminder of the ever-evolving and increasingly sophisticated landscape of cyber threats. These breaches highlighted the urgency for enhanced cybersecurity measures, timely incident response, and collaborative efforts across industries and governments to fortify defenses against relentless cyber adversaries.

As organizations continue to navigate the evolving threat landscape, investing in robust cybersecurity frameworks, employee training, and proactive threat detection and response mechanisms remains paramount to safeguarding sensitive data and ensuring the resilience of digital ecosystems.

Image Source: Freepik / DCStudio

The post Top Cybersecurity Data Breaches of 2023 appeared first on Hacking News.

The post Enhancing Cybersecurity: The Imperative of Biometric Authentication and the Intricacies of Typing Biometrics appeared first on Hacking News.

There have been many significant cyber security incidents in recent years, and it is difficult to rank them in terms of their importance or impact. Here is a list of ten examples of significant cyber security incidents that have occurred in the past few years:

1. The WannaCry ransomware attack in 2017, which affected more than 200,000 computers in over 150 countries and caused widespread disruption to organizations including the National Health Service in the UK.
2. The Equifax data breach in 2017, in which the personal information of 143 million people was exposed.
3. The SolarWinds hack in 2020, in which hackers gained access to the networks of multiple government agencies and private companies through a supply chain attack.
4. The Marriott data breach in 2018, in which the personal information of up to 500 million guests was exposed.
5. The Target data breach in 2013, in which the personal information of 40 million credit and debit card customers was exposed.
6. The Yahoo data breaches in 2013 and 2014, in which the personal information of all 3 billion Yahoo user accounts was exposed.
7. The Anthem data breach in 2015, in which the personal information of 78.8 million individuals was exposed.
8. The Adobe data breach in 2013, in which the personal information of 38 million users was exposed.
9. The Heartbleed vulnerability in 2014, which affected a widely-used open-source encryption software and exposed the personal information of millions of people.
10. The Dropbox data breach in 2012, in which the login credentials of 68 million user accounts were exposed.

These are just a few examples of significant cyber security incidents that have occurred in recent years. It is important for individuals and organizations to be aware of the risks and to take steps to protect themselves against cyber threats.

Cybersecurity refers to the practices and technologies that organizations and individuals use to protect against online threats such as hacking, malware, and phishing. Cyber attacks can take many forms and can have serious consequences, including financial loss, data theft, and damage to an organization’s reputation. It is important for individuals and organizations to be aware of the risks and to take steps to protect themselves against cyber threats. This can include using strong passwords, keeping software and security protocols up to date, and being cautious when sharing personal or sensitive information online.

The post Top 10 Cyber Security incidents from the last years appeared first on Hacking News.