Storybook dev server vulnerability CVE-2026-114125 (CVSS 9.4) enables code injection from malicious websites. Upgrade to 10.6.2, 9.1.21 or 8.6.19.

Related Posts:

• Electrum Wallet Vulnerability Exploits RBF Fee Bumps
• Microsoft Ships Out-of-Band .NET Updates for Brotli Overflow and Linux Tarball Flaws
• Apache Camel Fixes Eight Flaws, Including High-Severity XXE in camel-saxon

The post Storybook Fixes CVSS 9.4 Dev Server Flaw That Lets Malicious Sites Inject Code appeared first on Daily CyberSecurity.

Socket links GlassWorm VS Code themes to malicious VS Code extensions with 8,000+ installs, including a Coca-Cola theme. See how to check yours.

Related Posts:

• Moroccan Intelligence Deploys Vast Surveillance Panopticon
• DragonForce Backdoor Adds MQTT Fallback to Microsoft Teams TURN Command Channel
• New 2CLoader Malware Delivers Vidar and Remus Infostealers While Dodging Sandboxes

The post Socket Links Popular VS Code Color Themes to the GlassWorm Supply Chain Campaign appeared first on Daily CyberSecurity.

Security researchers found 150 lookalike Open VSX extensions published under trusted names, highlighting how extension marketplaces can expose developer credentials, source code, and CI/CD systems to supply-chain risk.

The post 77 Counterfeit Open VSX Extensions Collected Developer and CI/CD Data appeared first on TechRepublic.

GitHub’s new Actions safeguard pauses potentially malicious workflow runs before execution, leaving repository owners to decide who can approve them and what checks must come first.

The post GitHub Automatically Holds Suspicious Actions Runs, but Repository Owners Must Approve Them appeared first on TechRepublic.

Cursor has patched a high-severity Windows vulnerability that allowed malicious Git repositories to execute code, highlighting security risks in AI coding environments.

The post Cursor Quietly Patches High-Severity Git Vulnerability After Seven-Month Delay appeared first on TechRepublic.

A SimpleHelp authentication flaw is being exploited to deploy Djinn Stealer, a cross-platform malware targeting cloud, developer, and AI credentials.

The post SimpleHelp Flaw Exploited to Deploy Malware Targeting Windows, macOS, and Linux appeared first on TechRepublic.