Supply Chain Security Archives • Page 2 of 2 • Daily CyberSecurity

Poisoned Comments: Critical Orval Flaw (CVE-2026-25141) Injects Code

CVE-2026-25141 Orval Vulnerability CVE-2026-23947

Poisoned Comments: Critical Orval Flaw (CVE-2026-25141) Injects Code

Do Son February 4, 2026

Critical Orval flaw CVE-2026-25141 (CVSS 9.3) allows code injection via OpenAPI comments. 2.8M+ downloads affected. Update to v7.21.0 now.

Discontinued Library: High-Severity lz4-java Flaw (CVE‐2025‐12183) Forces Immediate Migration to Community Fork lz4-java Out-of-bounds Read, Library EOL

lz4-java Out-of-bounds Read, Library EOL

Discontinued Library: High-Severity lz4-java Flaw (CVE‐2025‐12183) Forces Immediate Migration to Community Fork

Do Son December 3, 2025

A critical vulnerability in the abandoned lz4-java library exposes apps to DoS. Discover the fix and the mandatory fork migration path here.

PyPI Warns of Sophisticated Phishing Campaign Targeting Python Developers Layoff Phishing Scam Remcos RAT Malware Aruba Phishing, Phishing-as-a-Service PyPI, phishing CVE-2024-25608 PyPI Phishing, Credential Theft

Layoff Phishing Scam Remcos RAT Malware Aruba Phishing, Phishing-as-a-Service PyPI, phishing CVE-2024-25608 PyPI Phishing, Credential Theft

PyPI Warns of Sophisticated Phishing Campaign Targeting Python Developers

Do Son July 29, 2025

PyPI warns of a new phishing campaign using "pypj.org" to spoof its login page, tricking maintainers into revealing credentials. PyPI itself is not compromised.

PyPI Bans Inbox.ru After Massive Spam Campaign and 1,500+ Fake Project Uploads PyPI Spam, Package Impersonation

PyPI Bans Inbox.ru After Massive Spam Campaign and 1,500+ Fake Project Uploads

Do Son July 17, 2025

PyPI has banned inbox.ru registrations after a large-scale spam campaign created over 1,500 fake projects, exploiting name confusion and impersonation.

Critical CI/CD Cache Poisoning Threatens Supply Chain: Undetectable Code Injection Possible! CI/CD Security, Cache Poisoning

Critical CI/CD Cache Poisoning Threatens Supply Chain: Undetectable Code Injection Possible!

Do Son June 13, 2025

A critical CI/CD flaw in remote caches allows undetectable code injection and privilege escalation via cache poisoning, bypassing all security controls.

Path Traversal at Scale: Study Uncovers 1,756 Vulnerable GitHub Projects and LLM Contamination Path Traversal, LLM Vulnerabilities

Path Traversal at Scale: Study Uncovers 1,756 Vulnerable GitHub Projects and LLM Contamination

Do Son June 2, 2025

A study reveals widespread path traversal (CWE-22) in open-source projects, exacerbated by LLMs generating insecure code. Automated detection and patching are critical.

Jenkins Docker Images Vulnerable to SSH Host Key Reuse Jenkins RCE vulnerability active exploitation, CVE-2026-53435, CVE-2026-53436, CVE-2026-53437 Jenkins - CVE-2024-43044 Jenkins vulnerability SSH host key reuse

Jenkins RCE vulnerability active exploitation, CVE-2026-53435, CVE-2026-53436, CVE-2026-53437 Jenkins - CVE-2024-43044 Jenkins vulnerability SSH host key reuse

Jenkins Docker Images Vulnerable to SSH Host Key Reuse

Do Son April 11, 2025

A vulnerability in Jenkins Docker images (CVE-2025-32754, CVE-2025-32755) allows SSH host key reuse, enabling attackers to intercept and modify build processes. Update to jenkins/ssh-agent 6.11.2 to mitigate.