Curated developments in technology, systems security, and cloud infrastructure — handpicked, summarized with AI assistance, and linked back to the original source.
security
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
Trend Micro found 14 npm packages posing as calendar and streak utilities that launch a bundled Linux backdoor the moment the module is imported — no install hook needed. The implant is RedC2 4.0, a cross-platform C2 framework whose 'Red Agent' lets operators type natural-language commands that an LLM turns into beacon actions, lowering the skill needed for multi-stage intrusions. Audit your dependencies and watch for binaries executing during module load.
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point Research showed that BTR.sys, the signed boot-time remediation driver inside Defender's engine, can be driven with a hard-coded RC4 key to perform arbitrary kernel-level file and registry operations before Defender's own services start — enough to delete WdFilter.sys or MsMpEng.exe. It requires an admin account with SeLoadDriverPrivilege, which is why Microsoft says it does not meet the bar for servicing; no patch is planned.
Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0
Cisco's latest internal-review batch fixes four Crosswork and five Secure Workload vulnerabilities, five of them maximum severity: SQL injection, missing authentication, and authentication/access-control bypasses that allow unauthenticated command execution. They were found internally with no known exploitation; fixed builds are Crosswork 7.2.1-SP and Secure Workload 3.10.9.1 / 4.0.4.16.
GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure
A CVSS 9.4 code-injection flaw in GitLab's GraphQL API lets unauthenticated attackers modify or delete publicly accessible projects — wipe repositories, forge merge records, even ban maintainers. watchTowr saw it hit their honeypots within days of disclosure; upgrade to 19.2.4 / 19.1.6 / 19.0.8 / 18.11.11, or restrict unauthenticated access to /api/graphql until you can.
Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution
CVE-2026-69836 is a deserialization-of-untrusted-data bug in Entra ID that could have allowed remote code execution against Microsoft's cloud identity service. Microsoft says it is fully mitigated on its side with no customer action needed, and has walked back an initial claim that the flaw was exploited in the wild.
Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
A compromised maintainer account pushed malicious releases of arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 to crates.io, each pulling in a typosquatted proc-macro1 dependency whose build script downloads and runs a credential-stealing implant at compile time. The crates were yanked within about 90 minutes and no confirmed victims are known, but arrayref alone has 245M downloads — check ~/.cargo/registry/cache for the bad versions and pin arrayref to 0.3.9 or earlier.