PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
CVE-2026-0759 is a critical OS command injection vulnerability in the Katana Network Development Starter Kit's executeCommand method. It allows unauthenticated remote attackers to execute arbitrary code with the privileges of the service account. The flaw arises from improper validation of user-supplied input before executing system calls. Exploitation requires no user interaction and can fully compromise affected systems. Although no public exploits are known yet, the high CVSS score (9.8) indicates severe risk. European organizations using this development kit in network or IoT environments are at significant risk. Mitigation involves immediate input validation improvements, restricting command execution contexts, and network-level protections. Countries with strong technology sectors and IoT deployments, such as Germany, France, and the UK, are likely most affected. Vigilance and rapid patching or compensating controls are essential to prevent potential exploitation and data breaches.
CVE-2026-20904 is a medium severity vulnerability in the Gitea open source Git server where authenticated users can improperly toggle the visibility of other users' OpenID URIs due to insufficient ownership validation. This improper access control flaw allows attackers to alter identity visibility settings without authorization, potentially impacting user privacy and trust. The vulnerability requires authentication but no user interaction beyond that, and does not affect confidentiality directly but impacts integrity of user settings. There are no known exploits in the wild yet. European organizations using Gitea for source code management should assess their exposure and apply mitigations promptly. The vulnerability is particularly relevant for countries with strong open source adoption and active software development communities. Mitigation involves restricting access controls, auditing user permissions, and monitoring changes to OpenID visibility settings. No official patch links are currently available, so organizations should follow Gitea updates closely. Overall, this vulnerability highlights the importance of strict access control enforcement in collaborative development platforms.
CVE-2026-20888 is a medium severity vulnerability in the Gitea Open Source Git Server where improper access control allows users with read access to pull requests to cancel scheduled auto-merges initiated by other users. This flaw arises from insufficient authorization checks in the web interface when handling auto-merge cancellations. Exploitation does not require user interaction but does require at least read-level privileges. The vulnerability impacts the integrity of the development workflow by enabling unauthorized interference with merge operations, though it does not affect confidentiality or availability. No known exploits are currently reported in the wild. European organizations using Gitea for source code management should review their access control policies and update or patch affected versions once fixes are available.
CVE-2026-20883 is an improper access control vulnerability in Gitea's stopwatch API that allows users whose access to private repositories has been revoked to still view issue titles and repository names via previously started stopwatches. This vulnerability affects Gitea, an open-source Git server widely used for source code management. The flaw arises because the stopwatch API does not re-validate repository permissions after access revocation, leading to unauthorized information disclosure. The CVSS score of 6.5 indicates a medium severity with high confidentiality impact but no integrity or availability impact. Exploitation requires at least low privileges and no user interaction, making it moderately easy to exploit. European organizations using Gitea for private repository hosting could face information leakage risks, potentially exposing sensitive project details. Mitigation involves updating Gitea to a fixed version once available, auditing stopwatch API usage, and restricting stopwatch functionality to trusted users. Countries with strong software development sectors and high adoption of open-source tools, such as Germany, France, and the UK, are most likely to be affected. Overall, defenders should prioritize patching and access control reviews to prevent unauthorized data exposure through this vulnerability.
CVE-2026-20800 is a medium-severity vulnerability in the Gitea Open Source Git Server's notification API, where repository access permissions are not re-validated when returning notification details. This flaw allows users who have had their access to private repositories revoked to still view issue and pull request titles through previously received notifications. The vulnerability impacts confidentiality but does not affect integrity or availability, and it requires the attacker to have had prior access to the repository. No user interaction is needed once access is revoked, and exploitation can be performed remotely with low complexity. There are no known exploits in the wild, and no patches have been released yet. European organizations using Gitea for private repository management should be aware of potential sensitive information exposure risks. Mitigation involves auditing notification access controls, restricting notification content, and monitoring user access revocations closely. Countries with significant open source development communities and high adoption of Gitea, such as Germany, France, and the Netherlands, are more likely to be affected.
A North Korea-linked threat actor known as KONNI has been observed conducting a phishing campaign targeting software developers and engineering teams, particularly those with blockchain expertise. The campaign uses AI-generated PowerShell backdoors and targets a broader range of countries in the APAC region. The infection chain begins with a Discord-hosted link downloading a ZIP archive containing a PDF lure and a malicious LNK file. The LNK file deploys additional components, including the AI-generated PowerShell backdoor. The backdoor employs various anti-analysis techniques and establishes persistence through scheduled tasks. This campaign demonstrates KONNI's evolution in tactics and tooling, including the adoption of AI-assisted malware development.
CVE-2026-24042 is a critical missing authorization vulnerability in Appsmith versions 1.94 and below. It allows unauthenticated users to execute unpublished, edit-mode actions by manipulating the POST /api/v1/actions/execute endpoint with the viewMode parameter. This bypasses the intended publish boundary, exposing sensitive data and enabling execution of development queries and APIs. The flaw can lead to unauthorized data access and unintended side effects. No official patch is available at the time of disclosure. The vulnerability has a CVSS score of 9.4, indicating high exploitability and impact without requiring authentication or user interaction. European organizations using Appsmith for internal tools and dashboards are at risk, especially those with publicly accessible apps. Immediate mitigation and monitoring are advised to prevent exploitation.
Visual Studio Code is a popular open-source code editor[1]. But it's much more than a simple editor, it's a complete development platform that supports many languages and it is available on multiple platforms. Used by developers worldwide, it's a juicy target for threat actors because it can be extended with extensions.
The Evelyn Stealer campaign targets software developers through weaponized Visual Studio Code extensions, employing a multistage delivery of information-stealing malware. The attack chain involves a downloader disguised as a legitimate Lightshot DLL, an injector that uses process hollowing to inject the final payload, and the Evelyn Stealer itself. The malware implements sophisticated anti-analysis techniques, collects sensitive information including browser credentials and cryptocurrency data, and exfiltrates the stolen data via FTP. This campaign highlights the increasing threat to developer communities and the need for enhanced security measures in development environments.
CVE-2025-66803 is a medium-severity race condition vulnerability in the turbo-frame element handler of Hotwired Turbo before version 8.0.x. This flaw causes logout operations to fail because delayed frame responses can reapply session cookies after a user logs out, potentially allowing session persistence. Remote attackers can exploit this by inducing selective network delays, while physically proximate attackers may exploit naturally occurring race conditions on shared computers. The vulnerability impacts confidentiality and integrity by enabling unauthorized session continuation but does not affect availability. No known exploits are currently reported in the wild. European organizations using Hotwired Turbo in web applications should prioritize patching and implement network controls to mitigate exploitation risks. Countries with significant web development sectors and high adoption of Hotwired Turbo, such as Germany, the UK, and France, are more likely to be affected.
CVE-2026-0943 is a high-severity vulnerability in HarfBuzz::Shaper versions prior to 0.032 for Perl, caused by a null pointer dereference in a bundled HarfBuzz library (version 8.4.0 or earlier). This flaw leads to a denial of service (DoS) condition without requiring authentication or user interaction. The vulnerability stems from a dependency on a vulnerable third-party component, specifically HarfBuzz affected by CVE-2026-22693. Although no known exploits are currently in the wild, the vulnerability's ease of remote exploitation and impact on availability make it a significant risk. European organizations using affected versions in their software stacks, especially those relying on Perl bindings for text shaping or rendering, should prioritize patching or mitigating this issue. Countries with strong software development sectors and extensive use of open-source libraries are more likely to be impacted. Immediate mitigation involves updating to HarfBuzz::Shaper version 0.
esm.sh is a no-build content delivery network (CDN) for web development. Prior to Go pseeudoversion 0.0.0-20260116051925-c62ab83c589e, the software has a path traversal vulnerability due to an incomplete fix. `path.Clean` normalizes a path but does not prevent absolute paths in a malicious tar file. Commit https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16, corresponding to pseudoversion 0.0.0-20260116051925-c62ab83c589e, fixes this issue.
CVE-2025-14894 is a high-severity vulnerability in the bee interactive Livewire Filemanager used in Laravel applications. The vulnerability arises from the lack of file type and MIME validation in LivewireFilemanagerComponent.php, allowing attackers to upload malicious PHP files. These files can then be executed via the /storage/ URL if the Laravel application has been set up in a common manner. This results in remote code execution (RCE) without requiring authentication or user interaction. Although no known exploits are currently in the wild, the vulnerability poses a significant risk due to its ease of exploitation and potential impact. Organizations using this component should urgently review their file upload handling and apply mitigations. European organizations using Laravel with this file manager are particularly at risk, especially in countries with high Laravel adoption and active web development sectors.
A North Korean malware was discovered in an Upwork cryptocurrency project, leading to a five-day investigation into active Lazarus Group infrastructure. The malware utilized three infection mechanisms: VSCode auto-execution, backend RCE via Function Constructor, and cookie payload delivery. The infrastructure included Vercel-hosted Stage 1 C2 servers and dedicated Stage 2 C2 servers. A timing oracle allowed for token enumeration, revealing three active campaigns. The payload chain consisted of various modules for data extraction, RAT functionality, and cryptocurrency mining. The investigation uncovered sophisticated persistence mechanisms, masquerading techniques, and a custom binary protocol. Real-time defensive responses from the operators were observed during reconnaissance. The infrastructure blended legitimate-looking development projects with malicious activities for cover.
CVE-2025-8090 is a medium severity vulnerability in BlackBerry's QNX Software Development Platform versions 7.0 and 7.1. It involves a NULL pointer dereference in the MsgRegisterEvent() system call, which can be triggered by an attacker with local access and code execution privileges to crash the QNX Neutrino kernel. This results in a denial of service condition without impacting confidentiality or integrity. Exploitation requires local access but no user interaction or elevated privileges beyond code execution. There are currently no known exploits in the wild and no patches publicly available. The vulnerability primarily affects embedded systems running QNX, commonly used in automotive, industrial, and critical infrastructure sectors. European organizations relying on QNX-based systems could face operational disruptions if exploited. Mitigation involves restricting local access, monitoring for abnormal kernel crashes, and applying vendor patches once released.
Key takeaways VoidLink – a Cloud-First Malware Framework In December 2025, Check Point Research identified a small cluster of previously unseen Linux malware samples that appear to originate from a Chinese-affiliated development environment. Many of the binaries included debug symbols and other development artifacts, suggesting we were looking at in-progress builds rather than a finished, […] The post Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework appeared first on Check Point Research .
CVE-2026-22812 is a high-severity vulnerability in anomalyco's OpenCode AI coding agent versions prior to 1.0.216. The flaw involves the automatic startup of an unauthenticated HTTP server that permits any local process or any website (due to permissive CORS settings) to execute arbitrary shell commands with the user's privileges. This missing authentication for a critical function allows attackers to compromise confidentiality, integrity, and availability of affected systems. The vulnerability is fixed in version 1.0.216. Although no known exploits are currently reported in the wild, the ease of exploitation and potential impact make it a significant threat. European organizations using vulnerable OpenCode versions are at risk, especially those with development environments or CI/CD pipelines integrating this tool.
Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed to be strings and passed unmodified to Preact as children, a specially-crafted JSON payload could be constructed that would be incorrectly treated as a valid VNode. When this chain of failures occurs it can result in HTML injection, which can allow arbitrary script execution if not mitigated by CSP or other means. Applications using affected Preact versions are vulnerable if they meet all of the following conditions: first, pass unmodified, unsanitized values from user-modifiable data sources (APIs, databases, local storage, etc.) directly into the render tree; second assume these values are strings but the data source could return actual JavaScript objects instead of JSON strings; and third, the data source either fails to perform type sanitization AND blindly stores/returns raw objects interchangeably with strings, OR is compromised (e.g., poisoned local storage, filesystem, or database). Versions 10.26.10, 10.27.3, and 10.28.2 patch the issue. The patch versions restore the previous strict equality checks that prevent JSON-parsed objects from being treated as valid VNodes. Other mitigations are available for those who cannot immediately upgrade. Validate input types, cast or validate network data, sanitize external data, and use Content Security Policy (CSP).
Three malicious npm packages were discovered in November 2025, designed to deliver and install a new RAT malware family named NodeCordRAT. The packages, bitcoin-main-lib, bitcoin-lib-js, and bip40, mimicked legitimate Bitcoin-related libraries to deceive developers. NodeCordRAT uses Discord for command-and-control communication, targets Chrome credentials, sensitive secrets, and MetaMask data. It performs host fingerprinting, executes shell commands, captures screenshots, and exfiltrates data. The malware exploits software supply chain vulnerabilities, highlighting the importance of vigilance in package management. Although removed from npm, the incident serves as a reminder of ongoing threats in the software development ecosystem.
