LIVE · cybersecurity feed
Live wire
Manic: The Android Malware That Exfiltrates Data Even When the Phone Is OfflineHackers poison arrayref Rust crate to push infostealer malwareNSA, CISA, FBI, DOE, and EPA Warn of Active AI-Assisted Attacks on Siemens S7 PLCsSenators press TikTok over withholding of safety features for some usersAI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical InfrastructureChatGPT for Teens tackles risky chats and homework shortcutsCritical Elementor Pro bug exposes WordPress sites to RCE attacksNew Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat DataFrequently asked questions about the active threat to Siemens S7 Series PLCsIsolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE

node.js

javascriptcritical

Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE

A critical vulnerability has been discovered in the isolated-vm Node.js library, allowing sandboxed JavaScript code to escape and potentially execute arbitrary code on the host system. The flaw, found in the ExternalCopy component, enables memory corruption and control-flow hijacking. While the isolation primitive itself remains sound, the C++ binding layer that facilitates data transfer across boundaries was found to be vulnerable. Patches are available in versions 6.2.0 and 7.0.1.