Do Son Four undici vulnerabilities (CVE-2026-6734, CVE-2026-9697) affect the Node.js HTTP client, which sees 133M weekly downloads. Update undici now.
WebSocket
Laravel Reverb flaw CVE-2026-23524 (CVSS 9.8) puts 7M apps at risk of RCE via Redis. Update to v1.7.0 or disable scaling now to stay secure.
Spring fixed two flaws: CVE-2025-41253 allows SpEL injection in Cloud Gateway to expose secrets, and CVE-2025-41254 allows STOMP CSRF to send unauthorized WebSocket messages. Update immediately.
A new BankBot campaign targets Android users in Indonesia and Vietnam. The malware uses spoofed app stores and a WebSocket-based download for stealth.
Learn about Last Mile Reassembly attacks and how they can bypass Secure Web Gateway systems, posing a threat to corporate networks.