Search: development.we

A persistent cross-site scripting (XSS) vulnerability was discovered in esbuild, a widely used JavaScript bundler with over 5 billion downloads. This bug bypassed HTML sanitization mechanisms, allowing malicious scripts to be injected and executed in affected applications. Although no known exploits are currently in the wild, the vulnerability poses a medium risk due to its potential to compromise web application security. The flaw could lead to unauthorized data access, session hijacking, or further exploitation if leveraged by attackers. European organizations using esbuild in their web development pipelines may be at risk, especially those in sectors with heavy reliance on JavaScript frameworks. Mitigation requires updating to patched versions once available, implementing additional input validation, and employing robust Content Security Policies (CSP). Countries with significant software development industries and high adoption of modern web technologies, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the ease of exploitation through crafted inputs and the broad usage of esbuild, the suggested severity is medium. Defenders should prioritize monitoring for suspicious script injections and prepare to apply patches promptly.

News#netsec#redditGermany+5

Sturnus is a newly identified Android banking trojan targeting financial institutions in Southern and Central Europe. It features advanced capabilities such as full device takeover, harvesting banking credentials, keylogging, and remote control via VNC. Notably, it can bypass encryption on popular messaging apps like WhatsApp, Telegram, and Signal to monitor communications. The malware uses sophisticated communication protocols including WebSocket and HTTP to interact with its command-and-control servers. Although still in development and not yet exploited in the wild, Sturnus poses a significant threat to financial security and user privacy. It employs HTML overlays for data exfiltration and extensive environment monitoring to evade detection. The malware’s complexity and targeting of Android devices make it a serious concern for European financial sectors. Defenders should prioritize detection and containment measures to mitigate potential impacts.

Campaign#banking trojan#remote controlItaly+6

The Android malware is in development and appears to be mainly aimed at users in Europe. The post New Sturnus Banking Trojan Targets WhatsApp, Telegram, Signal Messages appeared first on SecurityWeek .

Malware#androidGermany+7

The October 2025 Infostealer Trend Report highlights the ongoing and evolving threat posed by Infostealer malware families such as Rhadamanthys, ACRStealer, and LummaC2. Attackers have shifted distribution tactics, increasingly leveraging legitimate websites to evade detection and search engine restrictions, a technique known as SEO poisoning. A notable development is the mass distribution of a new Loader malware employing DLL sideloading to execute malicious payloads stealthily. The report also details changes in LummaC2 distribution patterns and the use of sophisticated disguise and phishing techniques to target companies. These Infostealers aim to exfiltrate sensitive information, posing risks to confidentiality and potentially enabling further attacks. The threat does not require known exploits or zero-day vulnerabilities but relies on social engineering and advanced evasion methods. European organizations are at risk due to the widespread use of affected malware and the targeting of companies via phishing. Mitigation requires proactive detection of DLL sideloading, monitoring for SEO poisoning campaigns, and enhanced phishing defenses.

Campaign#seo poisoning#rhadamanthysGermany+5

CVE-2025-12121 is a remote code execution (RCE) vulnerability affecting LITE XL, a lightweight text editor. This flaw allows an attacker to execute arbitrary code on a victim's system by exploiting the vulnerable application, potentially leading to full system compromise. Although no known exploits are currently in the wild, the vulnerability is considered medium severity due to its impact and exploitation complexity. European organizations using LITE XL, especially in software development or IT environments, could be at risk if the vulnerability is exploited. Mitigation requires applying patches once available, restricting application usage, and monitoring for suspicious activity. Countries with higher adoption of open-source and developer tools, such as Germany, France, and the UK, may be more affected. Given the lack of authentication requirements and the ability to execute code remotely, the threat is assessed as high severity. Defenders should prioritize vulnerability management and user education to reduce risk.

EPSS 0.4%Vulnerability#netsec#redditGermany+2

esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the ?module query parameter, esm.sh converts it to a JavaScript module by embedding the CSS content directly into a template literal without proper sanitization. An attacker can inject malicious JavaScript code using ${...} expressions within CSS files, which will execute when the module is imported by victim applications. This enables Cross-Site Scripting (XSS) in browsers and Remote Code Execution (RCE) in Electron applications. This issue has been patched in version 136.

esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.

Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any image file accessible to the Node.js process on the host system. This issue has been patched in version 5.14.3.

This threat analysis highlights how certain legitimate Python packages can be repurposed by attackers to build surveillance and spyware tools. These packages enable capabilities such as keylogging, screen capture, webcam access, and browser data extraction. The write-up emphasizes the ease with which these libraries can be misused to create full-scope monitoring malware without requiring vulnerabilities in the packages themselves. While no direct exploits or vulnerabilities are reported, the potential for abuse exists due to the functionality these packages provide. The threat is categorized as medium severity given the potential impact on confidentiality and privacy, combined with the ease of misuse by attackers. European organizations using Python in development or automation environments could be targeted for espionage or data theft. Mitigations focus on developer awareness, supply chain security, and monitoring for suspicious use of these packages. Countries with strong software development sectors and critical infrastructure relying on Python are most likely to be affected. This analysis is based on a recent audit-style report shared on Reddit’s NetSec community and does not describe an active exploit campaign.

Malware#netsec#redditGermany+7

### Summary The `ExceededSizeError` exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload. ### Details In situations where a misconfigured — or entirely absent — production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing the full JWT header during the `joserfc.jwt.decode()` operation. The same behavior also appears when validating claims and signature payload sizes, as the library raises `joserfc.errors.ExceededSizeError()` with the full payload embedded in the exception message. Since the payload is already fully loaded into memory at this stage, the library cannot prevent or reject it per se. It is therefore the responsibility of the underlying web server (`uvicorn`/`h11`, `gunicorn`, `Starlette`, `Werkzeug`, `nginx`...etc) to enforce limits on header sizes. For example, a `FastAPI`/`Starlette` application running _without_ `uvicorn` and/or `gunicorn` cannot enforce header size limits on its own. With `uvicorn`/`h11`, the [--h11-max-incomplete-event-size <int>](https://uvicorn.dev/settings/#implementation:~:text=%2D%2Dh11%2Dmax%2Dincomplete%2Devent%2Dsize%20%3Cint%3E) option can restrict the total size of the header _plus_ body, but not the header alone. Similarly, [vLLM serve](https://docs.vllm.ai/en/latest/cli/serve/#-h11-max-incomplete-event-size) —due to its reliance on `uvicorn`/`h11` and the need for heavy data transfer in ML inference workloads, sets a default limit of 4 MB for header _plus_ body and is frequently increased. In practice, a robust reverse proxy (such as `nginx`) is typically required because it can explicitly cap maximum header size. Unfortunately, many web applications do not run behind a proper reverse proxy. Given these constraints, the `joserfc` library cannot safely log or embed payloads of arbitrary size. This issue is particularly subtle, as it occurs only when a maliciously crafted JWT finally reaches the Python application, a scenario that most developers will never encounter during routine development and testing. ### PoC **Environment** Ubuntu 24.04 LTS Python 3.12 Tested on `joserfc` version `1.4.1` ```python import logging from datetime import UTC, datetime, timedelta from joserfc import jwt from joserfc.errors import ExceededSizeError, UnsupportedAlgorithmError from joserfc.jwk import OctKey logger = logging.getLogger(__name__) SECRET_KEY = "8c13bd66babc241b29f8553429bdab7deb6f5b74ddfda7765471e57ecd55641e" LONG_JWT_TOKEN = ( "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGQifQ" "." "eyJpc3MiOiJhdXRoX3NlcnZlciIsImlhdCI6MTc2MzI0OTEwMSwiZXhwIjoxNzY5MjQ5MTAxfQ" "." "6-k2jmkGXD6wXOgYgjPS8E5lS_GjWpgIuY54gokjAn8" ) HEADER = { "alg": ( "RS256dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" "RS256dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" "RS256dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" "RS256dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" "RS256dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" "RS256dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ), } CLAIMS = { "iss": "auth_server", "iat": datetime.now(UTC), "exp": datetime.now(UTC) + timedelta(minutes=15), } def main(): # Create OctKey from SECRET_KEY key = OctKey.import_key(SECRET_KEY) # Simulate creating a very large JWT # (this will fail with joserfc.errors.UnsupportedAlgorithmError # due to an invalid 'alg' header content try: token = jwt.encode(HEADER, CLAIMS, key) except UnsupportedAlgorithmError: # Use a forged token that has the same header and claims instead # but an invalid signature token = LONG_JWT_TOKEN logger.warning(f"Created JWT: {token}") # Now try to decode the large JWT try: decoded_token = jwt.decode(token, key) logger.warning("This line will never be reached.") logger.warning(decoded_token.claims) except ExceededSizeError: logger.exception( "The JWT size is too large and may be a security attack attempt." ) # this i

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. When the ESP32 is in advertising mode, if it receives a connection request containing an invalid Access Address (AA) of 0x00000000 or 0xFFFFFFFF, advertising may stop unexpectedly. In this case, the controller may incorrectly report a connection event to the host, which can cause the application layer to assume that the device has successfully established a connection. This issue has been fixed in versions 5.5.2, 5.4.3, 5.3.5, 5.2.6, and 5.1.7. At time of publication versions 5.5.2, 5.3.5, and 5.1.7 have not been released but are fixed respectively in commits 3b95b50, e3d7042, and 75967b5.

The adoption of the Rust programming language in Android development has driven memory safety bugs below 20% for the first time, marking a significant improvement in Android security. This reduction in memory-related vulnerabilities is attributed to Rust's inherent memory safety features, which prevent common issues like buffer overflows and use-after-free errors. While this news highlights positive progress rather than a direct threat, it reflects evolving security practices that impact vulnerability landscapes. European organizations relying on Android devices may benefit from improved platform security, reducing risks from memory corruption exploits. However, this is not a new vulnerability or active threat but rather an informative update on security trends. No known exploits are currently in the wild related to this topic. The severity is assessed as low since this is a security improvement rather than a threat. Defenders should continue to monitor Android updates and encourage adoption of safer coding practices. Countries with significant Android user bases and development ecosystems, such as Germany, France, and the UK, are most relevant to this trend. Overall, this is positive news indicating a reduction in memory safety vulnerabilities due to Rust adoption in Android codebases.

News#infosecnews#redditGermany+6

The OpenJDK 8 packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. This release of the Red Hat build of OpenJDK 8 (8u472) for Windows serves as a replacement for the Red Hat build of OpenJDK 8 (8u462) and includes security and bug fixes as well as enhancements. For further information, refer to the release notes linked to in the References section. Security Fix(es): * JDK: Enhance Path Factories (CVE-2025-53066) * JDK: Enhance Certificate Handling (CVE-2025-53057) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Reposecu is a newly introduced multi-layered static application security testing (SAST) platform integrating Semgrep, Trivy, and Detect-Secrets for GitHub repositories. Currently in beta, it aims to streamline code, dependency, configuration, and secret scanning with a simple interface. Despite being a security tool, the announcement contains no direct evidence of a vulnerability or exploitation within Reposecu itself. The mention of tags like 'rce' and 'vulnerability' appears to be generic or aspirational rather than indicative of a confirmed security flaw. There are no affected versions, patches, or known exploits reported. European organizations should be cautious when adopting beta security tools, ensuring thorough vetting before integration. Countries with strong software development sectors and high GitHub usage, such as Germany, the UK, France, and the Netherlands, are most likely to encounter this platform. Given the lack of concrete vulnerability details, the threat severity is assessed as medium, primarily due to the potential risks of immature beta software handling sensitive codebases. Defenders should verify the security posture of Reposecu before deployment and monitor for updates or disclosed vulnerabilities.

Vulnerability#netsec#redditGermany+3

CVE-2025-47913 is a high-severity vulnerability in the golang.org/x/crypto SSH agent package where SSH clients panic and terminate unexpectedly upon receiving an SSH_AGENT_SUCCESS message when a typed response is expected. This improper handling of exceptional conditions (CWE-703) leads to denial of service by crashing the client process without requiring authentication or user interaction. The vulnerability affects all versions of the golang.org/x/crypto/ssh/agent package and has a CVSS score of 7.5, indicating significant impact on availability. No known exploits are currently reported in the wild. European organizations using Go-based SSH clients that rely on this package may face service disruptions, particularly in critical infrastructure and development environments. Mitigation involves updating to patched versions once available and implementing robust error handling around SSH agent responses. Countries with strong software development sectors and critical infrastructure relying on Go are most at risk, including Germany, France, the UK, and the Netherlands.

EPSS 0.7%VulnerabilityCWE-703Germany+3

Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the `trailingSlash` configuration option is used. An attacker can inject arbitrary JavaScript code that executes in the victim's browser context by crafting a malicious URL. While this vulnerability only affects the development server and not production builds, it could be exploited to compromise developer environments through social engineering or malicious links. Version 5.15.6 fixes the issue.

A large-scale spam campaign involving tens of thousands of malicious NPM packages has been identified, distributing a self-replicating worm. The campaign appears to be orchestrated by an Indonesian threat actor, inferred from code comments and the random naming of packages. These malicious packages propagate by infecting other packages or systems, potentially compromising software supply chains. Although no known exploits in the wild have been reported yet, the widespread nature of the packages poses a significant risk. The threat primarily targets the JavaScript ecosystem, specifically developers and organizations relying on NPM packages. European organizations using NPM packages in their development workflows could face supply chain contamination, leading to data breaches, system compromise, or further malware propagation. Mitigation requires proactive package vetting, dependency auditing, and restricting automated package installations. Countries with strong software development sectors and high NPM usage, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the medium severity and the potential for widespread impact without requiring user interaction, the threat should be taken seriously and addressed promptly.

MalwareGermanyFrance+5

A security issue has been identified in mPDF, a widely used open-source PHP library for generating PDFs from HTML, with approximately 70 million installs. Due to quirks in its logic and the use of regex, it is possible to craft inputs that trigger unintended web requests, even when inputs are sanitized. This behavior can potentially lead to remote code execution (RCE) scenarios. Although no known exploits are currently active in the wild and no patches have been released, the threat is considered medium severity. European organizations using mPDF in web applications that process user-generated HTML content are at risk, especially those lacking additional input validation or network restrictions. Mitigations include applying strict input validation beyond mPDF’s internal sanitization, isolating PDF generation processes, and monitoring outbound web requests from servers. Countries with significant PHP development ecosystems and large web hosting industries, such as Germany, France, and the UK, are more likely to be affected. Given the potential for RCE without user interaction and the widespread use of mPDF, the suggested severity is high. Defenders should prioritize reviewing mPDF usage and implement compensating controls until an official patch is available.

News#netsec#redditGermany+5

An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials.

A critical remote code execution (RCE) vulnerability has been identified in the popular JavaScript library expr-eval. This flaw allows attackers to execute arbitrary code on systems using vulnerable versions of the library, potentially leading to full system compromise. Although no known exploits are currently in the wild, the high severity rating and the nature of RCE make this a significant threat. The vulnerability affects applications that parse and evaluate mathematical expressions using expr-eval, commonly used in web and server-side JavaScript environments. European organizations relying on this library in their software stacks could face risks to confidentiality, integrity, and availability if exploited. Immediate mitigation involves identifying usage of expr-eval and applying patches or workarounds once available. Countries with strong software development sectors and high adoption of JavaScript technologies, such as Germany, the UK, France, and the Netherlands, are more likely to be impacted. Given the ease of exploitation and potential for widespread impact, the suggested severity is critical. Defenders should prioritize inventorying affected systems, monitoring for suspicious activity, and preparing incident response plans.

Vulnerability#infosecnews#redditGermany+3