Help Net Security چهارشنبه 6 آبان 1405 · ۲۰:۳۹

GitHub’s npm package firewall can block brand-new versions before they install

GitHub announced a package firewall that checks npm packages against an enterprise’s policy before they install. It blocks known malware, critical vulnerabilities, and brand-new versions, and any developer can turn it on by pointing npm at the firewall. The checks run before a package reaches a laptop, a build, or a coding agent. GitHub says AI agents are helping developers build more software, faster, and the firewa…

بدافزار و آلودگی آسیب‌پذیری و روز صفر

خواندن متن کامل در Help Net Security درخواست حذف

این صفحه فقط عنوان و خلاصهٔ کوتاه خبر را نمایش می‌دهد. متن کامل در منبع اصلی منتشر شده است.

خبرهای مرتبط

آرشیو کامل ←

Unit 42 (Palo Alto) چهارشنبه 6 آبان 1405 · ۲۱:۳۰

Unwrapping Retail Peak Season Cyber Threats

Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust. The post Unwrapping Retail Peak Season Cyber Threats appeared first on Unit 42.

بدافزار و آلودگی باج‌افزار

منبع

The Hacker News چهارشنبه 6 آبان 1405 · ۲۰:۳۸

Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.

Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores get the features from December 1, but only on

بدافزار و آلودگی توسعه موبایل

منبع

Cisco Security Advisories چهارشنبه 6 آبان 1405 · ۲۰:۱۸

Vulnerabilities in PHP Affecting Cisco Products: October 2026

On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. These vulnerabilities are being referenced as PHP2shell. For information about Splunk pr…

آسیب‌پذیری و روز صفر

منبع

Zscaler ThreatLabz چهارشنبه 6 آبان 1405 · ۱۹:۴۱

CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE

IntroductionOn October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by Node.js and other software. The vulnerability is also known as Node2Shell and more recently as HTTP2Shell. The CVE score, filed by Google as the numbering authority, is 9.2 (Critical) on CVSS 4.0. The flaw can be triggered when a vulnerable process decompresses attack…

آسیب‌پذیری و روز صفر امنیت ابری برنامه‌نویسی و زبان‌ها

منبع