TIA · HYDRA
Cyber Signal
A daily cut from public sources. You don't subscribe to it. It just gets published.
No account. No email address. No tracking.
A daily cut from public sources. You don't subscribe to it. It just gets published.
No account. No email address. No tracking.
items report exploitation — not proof of concept
records parsed from the source feeds — before the time window and de-duplication
The digest hands us counts, not the discarded items — so this shows how many and why, not which.
July brought 4,084 new advisories for malicious npm packages. Other months run around 731 — July is a spike, not a trend.
All 8,189 of them, across seven months, are rated critical. Not one carries a computed CVSS score — there is nothing to score in a malicious package. It is not a flaw in the code, it is intent. Triage them by severity and every one is a tie.
But reach is distributed extremely unevenly. Of the 354 packages we could resolve, 67% have no dependents at all — their reach is zero. Among the rest the median multiplier is 1.95×, and 7% multiply thirtyfold or more. Highest measured case: engine.io has 118 direct dependents and reaches 15,865 through the tree. An average severity cannot see that spread at all.
Dependencies: a deps.dev v3alpha dependentCount measurement, SINGLE provider, no cross-check, window 2026-07. The package version is picked by a rule frozen BEFORE the run and BLIND to the measured value — the earlier method took the maximum across six versions, i.e. selected on the quantity it was meant to measure, and overstated the tail twofold. Amplification is undefined for packages with no dependents; those are reported separately as zero reach, not as a missing value. And advisories capture a fraction of malicious packages — this is the advisory denominator, not the malware denominator.
Attention classes are how much attention we gave an item. They are not severity verdicts.
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could…
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to run system level commands or…
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication…
View CSAF Summary This advisory is revoked. Re-investigation confirmed the reported behavior is expected platform…
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of…
Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure. The…
AI coding agents are changing how quickly developers can build and ship software as well as how quickly credentials can…
This installment of the Reporters' Notebook video series discusses the impact of AI agents breaching Hugging Face,…
Follow the day’s news live Get our breaking news email , free app or daily news podcast AI hack of Medicare exposes…
The vulnerabilities, tracked as CVE-2026-28324 and CVE-2026-28325, can be exploited without authentication.
Microsoft released the KB5124010 September 2026 non-security preview update for Windows 11 24H2 and 25H2, with 46 changes…
A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI…