Apple has released a comprehensive security update for iOS 26 and iPadOS 26, addressing 27 vulnerabilities across multiple system components. The update, released on September 15, 2025, targets devices including iPhone 11 and later models, along with various iPad generations from iPad Pro 12.9-inch 3rd generation onwards. Critical System Components Affected The security patches span 23 different system […]
A pair of medium-severity vulnerabilities in the Spring Framework and Spring Security libraries were disclosed on September 15, 2025. Both flaws involve the annotation detection mechanism used by Spring Security’s method security features and can lead to authorization bypass in applications that rely on parameterized types or unbounded generic superclasses. Users of affected versions should […]
A new Rowhammer attack variant named Phoenix can bypass the latest protections in modern DDR5 memory chips, researchers have revealed.
The attack is the first to demonstrate a practical privilege escalation exploit on a commodity system equipped with DDR5 RAM, undermining the assumption that these newer memory modules were immune to such threats.
Rowhammer is a long-standing hardware vulnerability where repeatedly accessing (or “hammering”) rows of memory cells in a DRAM chip can cause electrical interference, leading to bit flips in adjacent, unaccessed rows.
While numerous attacks have targeted older DDR3 and DDR4 memory, DDR5 was designed with more sophisticated in-DRAM Target Row Refresh (TRR) mechanisms to prevent this.
These mitigations were believed to be effective, as previous attempts to trigger Rowhammer bit flips on DDR5 devices had largely failed.
Self-Correcting Synchronization
Researchers from ETH Zurich and Google discovered that the TRR mechanisms in DDR5 chips from vendor SK Hynix operate over significantly longer and more complex patterns than those in DDR4.
To bypass these defenses, an attack must remain synchronized with thousands of periodic refresh commands issued by the memory controller.
The research team found that existing synchronization techniques were not reliable enough for this task, as they would frequently miss refresh commands and lose alignment, rendering the attack ineffective.
The key innovation behind the Phoenix attack is a technique the researchers call self-correcting synchronization. Instead of trying to avoid missing refresh commands, Phoenix is designed to detect when a refresh has been missed and automatically realign its hammering pattern accordingly.
hammering pattern
This allows the attack to maintain synchronization for the extended periods required to accumulate enough “hammers” to cause bit flips, even on a standard commodity computer with default settings.
By reverse-engineering the behavior of the TRR mechanisms, the team developed custom hammering patterns that exploit “blind spots” in the defense, hammering specific memory locations in lightly monitored refresh intervals.
The Phoenix attack proved highly effective in tests. It successfully triggered bit flips on all 15 commercial DDR5 memory modules from SK Hynix that were evaluated, which were manufactured between 2021 and 2024.
Using these bit flips, the researchers developed the first end-to-end Rowhammer exploit for DDR5, allowing them to gain the highest-level (root) privileges on a test system in as little as 109 seconds. The vulnerability has been assigned the identifier CVE-2025-6202.
The findings were responsibly disclosed to SK Hynix, CPU vendors, and major cloud providers in June 2025. While increasing the memory refresh rate by a factor of three was shown to mitigate the attack, it incurred a significant performance overhead of 8.4%.
The researchers argue that Phoenix demonstrates the need for manufacturers to implement principled, verifiable security measures rather than relying on proprietary, obscure mitigations that can be bypassed with enough effort.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
A sophisticated new information-stealing malware campaign dubbed Maranhão Stealer has emerged, targeting gaming enthusiasts through malicious pirated software distributed via cloud-hosted platforms. The campaign, first identified by security researchers in May 2025, represents a concerning evolution in credential theft operations, combining social engineering tactics with advanced evasion techniques to compromise user accounts and cryptocurrency wallets. The Maranhão […]
The NPM ecosystem is under attack once again, with a sophisticated supply chain compromise targeting the widely-used @ctrl/tinycolor package and over 40 other JavaScript packages. This latest incident represents a significant escalation in supply chain threats, featuring self-propagating malware that automatically spreads across the ecosystem. Diagram showing how phishing emails with malicious URLs or HTML […]
A recent vulnerability in the Linux Kernel’s KSMBD module allows an attacker to execute arbitrary code on a target system without any user interaction. KSMBD is a kernel-space SMB3 server that handles network file sharing. Researchers demonstrated a stable exploit against KSMBD in Linux 6.1.45, achieving remote code execution (RCE) with a success rate above […]
Microsoft has addressed a widespread audio issue affecting Bluetooth speakers, headsets, and integrated laptop speakers in Windows 11 version 24H2. The problem stemmed from an incompatibility with Dirac Audio software on certain devices, causing audio devices to go silent and applications to stop recognizing them. Resolves Bluetooth Audio Problem Following reports from users and IT […]
Open Source CyberSOCEval, a newly launched evaluation platform, is making waves in the cybersecurity community by demonstrating how artificial intelligence can transform malware analysis and threat intelligence. Developed by a group of independent security researchers, CyberSOCEval combines advanced machine learning models with real-world malware samples to offer organizations a clear view of how AI tools […]
Cybersecurity researchers have flagged a fresh software supply chain attack targeting the npm registry that has affected more than 40 packages that belong to multiple maintainers.
“The compromised versions include a function (NpmModule.updatePackage) that downloads a package tarball, modifies package.json, injects a local script (bundle.js), repacks the archive, and republishes it, enabling
A sophisticated and widespread supply chain attack has struck the NPM ecosystem, compromising the popular @ctrl/tinycolor package, which is downloaded over 2 million times per week.
The attack also affected more than 40 other packages from various maintainers, introducing a dangerous self-propagating malware designed to steal developer credentials and spread itself across the software landscape.
The incident came to light after users discovered suspicious activity on GitHub and promptly alerted the open-source community.
The malicious versions, identified as 4.1.1 and 4.1.2 of @ctrl/tinycolor, were quickly removed from the NPM registry, but not before they were distributed.
Security analysts from StepSecurity later provided a detailed technical breakdown of the attack, confirming its severity and unique propagation method.
Self-Spreading Malware Infects NPM Packages
What sets this attack apart is its automated, worm-like behavior. The malware contains a “self-propagation engine” that actively seeks out and infects other software packages.
Once a developer’s machine is compromised, the malware uses a function named NpmModule.updatePackage to inject its malicious code into other projects maintained by the same author.
This creates a cascading effect, allowing the threat to spread rapidly through the interconnected web of software dependencies without further manual intervention from the attackers.
The primary goal of the malware is aggressive credential harvesting. The attackers repurposed a legitimate secret-scanning tool, TruffleHog, to hunt for sensitive information on compromised systems. It specifically targets a wide range of valuable developer secrets, including:
NPM authentication tokens
GitHub personal access tokens
Amazon Web Services (AWS) access keys
Google Cloud Platform (GCP) service credentials
Microsoft Azure credentials
To ensure its persistence, the malware creates a malicious GitHub Actions workflow file named .github/workflows/shai-hulud-workflow.yml.
This file allows the attackers to maintain access to compromised repositories, potentially re-infecting them or exfiltrating more data over time. All stolen data was funneled to a publicly exposed endpoint on the webhook.site service.
Mitigations
In response to this critical threat, security experts are urging developers and organizations to take immediate action.
The first step is to check all projects for the presence of the compromised packages and their malicious versions. If found, they should be removed or downgraded to a safe version immediately.
Given the malware’s extensive credential-stealing capabilities, rotating all potentially exposed secrets is crucial. This includes NPM tokens, GitHub access tokens, and all cloud provider credentials (AWS, Azure, GCP) that may have been present on development or CI/CD systems.
Finally, a thorough audit of infrastructure is recommended. Developers should scan their repositories for the malicious shai-hulud-workflow.yml file, review recent NPM publishing activity for any unauthorized package releases, and monitor outbound network traffic for any connections to the known exfiltration endpoint.
Based on the information provided, here is a list of the compromised packages and their affected versions.
Affected Package
Malicious Version(s)
@ctrl/tinycolor
4.1.1, 4.1.2
@ctrl/deluge
7.2.2
angulartics2
14.1.2
@ctrl/golang-template
1.4.3
@ctrl/magnet-link
4.0.4
@ctrl/ngx-codemirror
7.0.2
@ctrl/ngx-csv
6.0.2
@ctrl/ngx-emoji-mart
9.2.2
@ctrl/ngx-rightclick
4.0.2
@ctrl/qbittorrent
9.7.2
@ctrl/react-adsense
2.0.2
@ctrl/shared-torrent
6.3.2
@ctrl/torrent-file
4.1.2
@ctrl/transmission
7.3.1
@ctrl/ts-base32
4.0.2
encounter-playground
0.0.5
json-rules-engine-simplified
0.2.4
@nativescript-community/gesturehandler
2.0.35
@nativescript-community/sentry
4.6.43
@nativescript-community/text
1.6.13
@nativescript-community/ui-collectionview
6.0.6
@nativescript-community/ui-drawer
0.1.30
@nativescript-community/ui-image
4.5.6
@nativescript-community/ui-material-bottomsheet
7.2.72
@nativescript-community/ui-material-core
7.2.76
@nativescript-community/ui-material-core-tabs
7.2.76
ngx-color
10.0.2
ngx-toastr
1.9.0.2
ngx-trend
8.0.1
react-complaint-image
0.0.35
react-jsonschema-form-conditionals
0.3.21
react-jsonschema-form-extras
1.0.4
rxnt-authentication
0.0.6
rxnt-healthchecks-nestjs
1.0.5
rxnt-kue
1.0.7
swc-plugin-component-annotate
1.9.2
ts-gaussian
3.0.6
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
