Sep 23, 2025
1 new incident, 1 with updates.
Started
- ClosedPatched
Google Chromium V8: Chromium V8 Type Confusion Vulnerability
Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine. Added to CISA KEV on 2025-09-23.
Google Chromium V8Closed Sep 23, 2025
Updated
- ClosedPatched
Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike
A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.
npm packages (@ctrl/tinycolor, @crowdstrike/*, 500+ others)Closed Sep 23, 2025
