Login

u/Deam00n

r/cybersecurity r/PhD
▲ 11 r/PhD

How do you keep self-imposed deadlines real when nobody enforces them?

So, as somebody who just finished their PhD (yay), I'v been thinking about something that bugged me my whole study, and is bugging me still. Motivation vs deadlines... As an example, advisor deadlines and submission dates tend to hold, but the in-between ones (finish the lit review section by Friday, send the draft...) slide constantly because nothing happens when you miss them. Plus my supervisor did not give a damn majority fo time, so I could ignore even some of the major deadlines for days or weeks, before any consequences.

What do you use? A writing group, a check-in with your advisor, locked calendar blocks, anything else that actually works?

reddit.com
u/Deam00n — 11 days ago
▲ 1 r/cybersecurity

12 npm/PyPI/supply-chain threats today (2026-05-27): CVE-2026-43945 (FUXA), CVE-2026-43947 (FUXA), Laravel Lang, durabletask, AntV, node-ipc, TanStack, lightning, ...

Today, May 27, 2026, we've identified 12 critical security threats across npm, PyPI, and supply-chain ecosystems. These vulnerabilities, detected in the past 24 hours, pose significant risks to software development.

# Package / Advisory Ecosystem Severity Fix
1 FUXA · CVE-2026-43945 npm CRITICAL Update
2 FUXA · CVE-2026-43947 npm CRITICAL Update
3 Laravel Lang Supply Chain Advisory Composer CRITICAL Uninstall / Audit
4 durabletask PyPI CRITICAL Uninstall / Audit
5 AntV Supply Chain Attack npm CRITICAL Uninstall / Audit
6 node-ipc npm CRITICAL Uninstall / Audit
7 TanStack Packages npm CRITICAL Uninstall / Audit
8 lightning PyPI CRITICAL Uninstall / Audit
9 FUXA · CVE-2026-43946 npm HIGH Update
10 yeoman-environment · CVE-2026-42089 npm HIGH 6.0.1
11 Armoli Technology Cargo Tracking System · CVE-2023-2065 Cargo HIGH Update
12 Log4j 1.x JMSSink · CVE-2022-23302 Maven HIGH Migrate away / Update
13 Langflow · CVE-2025-34291 PyPI HIGH Update
14 Argo CD · CVE-2022-24348 GitHub Actions HIGH Upgrade

FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

Ecosystem: npm CVE: CVE-2026-43945 Severity: CRITICAL This vulnerability chain in FUXA (v.1.3.0-2706) allows unauthenticated remote attackers to achieve Full Remote Code Execution (RCE) as root, even in secure configurations. Action Required: Upgrade to a version that addresses this vulnerability. Source

FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

Ecosystem: npm CVE: CVE-2026-43947 Severity: CRITICAL A vulnerability in FUXA's POST /api/runscript endpoint allows unauthenticated attackers to execute arbitrary code via test mode if a server-side script exists. Action Required: Upgrade to a version that addresses this vulnerability. Source

Laravel Lang Supply Chain Advisory

Ecosystem: Composer Severity: CRITICAL Hundreds of historical Laravel Lang Packagist releases were republished with malicious code, risking credential theft and secret exfiltration. Action Required: Remove or audit any Laravel Lang packages installed from Packagist. Use trusted sources for dependencies. Source

The AntV Supply Chain Campaign Expands: Microsoft's durabletask PyPI Package Compromised

Ecosystem: PyPI Severity: CRITICAL The AntV supply chain attack campaign has compromised durabletask, a Microsoft-associated Python package on PyPI, potentially exposing users to malicious code. Action Required: Remove or audit any durabletask packages installed from PyPI. Use trusted sources for dependencies. Source

Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account

Ecosystem: npm Severity: CRITICAL A compromised npm maintainer account led to the automated release of over 300 malicious package versions in the AntV ecosystem as part of the Mini Shai-Hulud campaign. Action Required: Audit your dependencies for any AntV packages. Remove or revert to known good versions. Source

Malicious node-ipc versions published to npm in suspected maintainer account compromise

Ecosystem: npm Severity: CRITICAL Multiple malicious versions of the popular node-ipc npm package were published to the npm registry, posing a risk to users. Action Required: Audit your dependencies for node-ipc. Remove or revert to known good versions. Source

TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack

Ecosystem: npm Severity: CRITICAL The Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 /* packages, chaining GitHub Actions vulnerabilities to achieve supply chain attacks with valid SLSA Build Level 3 attestations. Action Required: Audit your dependencies for u/tanstack* packages. Remove or revert to known good versions. Source

lightning PyPI Compromise: A Bun-Based Credential Stealer in Python

Ecosystem: PyPI Severity: CRITICAL A malicious release of the lightning PyPI package includes a credential-stealing Bun payload that runs on import, potentially compromising user credentials. Action Required: Remove or audit any lightning packages installed from PyPI. Use trusted sources for dependencies. Source

FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

Ecosystem: npm CVE: CVE-2026-43946 Severity: HIGH An authorization bypass in FUXA's /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Action Required: Upgrade to a version that addresses this vulnerability. Source

yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

Ecosystem: npm CVE: CVE-2026-42089 Severity: HIGH yeoman-environment versions >= 2.9.0 and < 6.0.1 can install arbitrary packages without confirmation, leading to potential code execution during CLI bootstrap. Action Required: Upgrade to version 6.0.1 or later. Source

CVE-2023-2065 - Authorization Bypass Through User-Controlled Key vulnerability in Armoli Technology Cargo Tracking System allows Authent

Ecosystem: Cargo CVE: CVE-2023-2065 Severity: HIGH An authorization bypass vulnerability in Armoli Technology Cargo Tracking System allows for authentication abuse and bypass. Action Required: Upgrade to a version that addresses this vulnerability. Source

CVE-2022-23302 - JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write acce

Ecosystem: Maven CVE: CVE-2022-23302 Severity: HIGH Log4j 1.x's JMSSink is vulnerable to deserialization of untrusted data, potentially leading to remote code execution if configured with an attacker-accessible LDAP service. Action Required: Upgrade to Log4j 2.x or migrate away from JMSSink. Source

CVE-2025-34291 - Langflow Origin Validation Error Vulnerability

Ecosystem: PyPI CVE: CVE-2025-34291 Severity: HIGH Langflow contains an origin validation error vulnerability due to permissive CORS configuration, allowing malicious webpages to perform cross-origin requests with credentials and potentially achieve system compromise. Action Required: Upgrade to a version that addresses this vulnerability. Source

Lessons learned from the Argo CD zero-day vulnerability (CVE-2022-24348)

Ecosystem: GitHub Actions CVE: CVE-2022-24348 Severity: HIGH This vulnerability in Argo CD highlights the risks of supply chain attacks and the importance of securing CI/CD pipelines. Action Required: Upgrade Argo CD to a patched version. Source

Automated daily digest — feedback welcome. Repo: https://github.com/Deam0on/wakellm

u/Deam00n — 5 months ago
▲ 10 r/cybersecurity

🚨 14 npm/PyPI/AI Supply-Chain Threats Today (2026-05-26): Critical Worms, Parse Server DoS, and AI RCEs

This is the daily security digest covering confirmed npm, PyPI, and supply-chain security threats detected in the past 24 hours. A total of 14 threats have been identified across various ecosystems, including active credential harvesting campaigns.

📊 Threat Summary

Package(s) Ecosystem Severity CVE Vulnerability
u/cap-js/sqlite, postgres, db-service npm CRITICAL CVE-2026-46421 Credential harvesting / Self-propagation
u/beproduct/nestjs-auth npm CRITICAL CVE-2026-46412 Mini Shai-Hulud worm payload
guardrails-ai PyPI CRITICAL CVE-2026-45758 Supply chain compromise
Parse Server npm HIGH CVE-2026-47138 DoS via header regex backtracking
qs npm HIGH CVE-2026-8723 Remotely triggerable DoS
u/libp2p/gossipsub npm HIGH CVE-2026-46679 Memory DoS (Subscription flood)
u/libp2p/kad-dht npm HIGH CVE-2026-45783 Disk exhaustion (Unvalidated PUT)
SQLFluff PyPI HIGH CVE-2026-46374 DoS via Resource Exhaustion
Diffusers ai-ml HIGH CVE-2026-45804 TOCTOU Remote Code Execution
lmdeploy ai-ml HIGH CVE-2026-46517 Unsafe remote-code load path
Crawlee for Python PyPI HIGH CVE-2026-46497 SSRF via sitemap-derived URLs
SillyTavern ai-ml HIGH CVE-2026-46372 SSRF in SearXNG Search Proxy
samlify npm HIGH CVE-2026-46490 XML Injection / Privilege Escalation
js-cookie npm HIGH CVE-2026-46625 Prototype hijack / Cookie injection

🚨 CRITICAL Alerts (Immediate Action Required)

1. u/cap-js ecosystem compromise (CVE-2026-46421)

  • Threat: Compromised versions of u/cap-js/sqlite, u/cap-js/postgres, and u/cap-js/db-service were published to harvest credentials and self-propagate.
  • Action: Upgrade immediately (sqlite >= 2.4.0, postgres >= 2.3.0, db-service >= 2.10.2). Assume all local credentials are compromised if you installed the malicious versions.

2. u/beproduct**/nestjs-auth worm (CVE-2026-46412)**

  • Threat: Malicious versions containing payloads from the Mini Shai-Hulud npm supply-chain worm campaign were published.
  • Action: Remove and reinstall dependencies. Audit for signs of compromise if installed during the affected window (v0.1.2 - 0.1.19).

3. guardrails-ai compromise (CVE-2026-45758)

  • Threat: A malicious version of guardrails-ai (0.10.1) was published to PyPI. It has been quarantined.
  • Action: Uninstall guardrails-ai==0.10.1 and reinstall a known good version.

⚠️ HIGH Severity Highlights

  • Denial of Service (DoS) Wave: Several major packages are vulnerable to crashing today. Parse Server (CVE-2026-47138) can be taken down pre-auth via a regex backtracking attack in the client version header. qs (CVE-2026-8723) will crash on specific null/undefined arrays. u/libp2p packages are vulnerable to both memory and disk exhaustion attacks.
  • AI Toolchain Remote Code Execution: Both Diffusers (CVE-2026-45804) and lmdeploy (CVE-2026-46517) have vulnerabilities bypassing trust_remote_code guardrails, allowing arbitrary remote code execution on model fetch.
  • SSRF & Injection: Crawlee for Python and SillyTavern both suffer from SSRF vulnerabilities requiring configuration updates. samlify is vulnerable to XML injection leading to privilege escalation, and js-cookie is vulnerable to a prototype hijacking attack.

Automated daily digest, created via https://github.com/Deam0on/wakellm - feedback welcome. Stay safe out there!

reddit.com
u/Deam00n — 5 months ago
▲ 11 r/cybersecurity

14 npm/PyPI/AI Supply-Chain Threats Today (2026-05-22): Critical Worms, Credential Harvesting, and RCEs

Threat Summary

Package(s) Ecosystem Severity CVE Vulnerability
u/cap-js/sqlite, postgres, db-service npm CRITICAL CVE-2026-46421 Credential harvesting / Self-propagation
u/beproduct/nestjs-auth npm CRITICAL CVE-2026-46412 Mini Shai-Hulud worm payload
guardrails-ai PyPI CRITICAL CVE-2026-45758 Supply chain compromise
PenPot MCP REPL npm HIGH CVE-2026-45805 Unauthenticated RCE
Diffusers ai-ml HIGH CVE-2026-45804 TOCTOU Remote Code Execution
lmdeploy ai-ml HIGH CVE-2026-46517 Unsafe remote-code load path
u/libp2p/gossipsub npm HIGH CVE-2026-46679 Memory DoS (Subscription flood)
u/libp2p/kad-dht npm HIGH CVE-2026-45783 Disk exhaustion (Unvalidated PUT)
Crawlee for Python PyPI HIGH CVE-2026-46497 SSRF via sitemap-derived URLs
SillyTavern ai-ml HIGH CVE-2026-46372 SSRF in SearXNG Search Proxy
samlify npm HIGH CVE-2026-46490 XML Injection / Privilege Escalation
js-cookie npm HIGH CVE-2026-46625 Prototype hijack / Cookie injection
SQLFluff PyPI HIGH CVE-2026-46374 DoS via Resource Exhaustion
pymdownx.snippets PyPI HIGH CVE-2026-46338 Path traversal bypass

CRITICAL Alerts (Immediate Action Required)

1. u/cap-js ecosystem compromise (CVE-2026-46421)

  • Threat: Compromised versions of u/cap-js/sqlite, u/cap-js/postgres, and u/cap-js/db-service were published to harvest credentials and self-propagate.
  • Action: Upgrade immediately (sqlite >= 2.4.0, postgres >= 2.3.0, db-service >= 2.11.0). Assume all local credentials are compromised if you installed the malicious versions.

2. u/beproduct**/nestjs-auth worm (CVE-2026-46412)**

  • Threat: Malicious versions containing payloads from the Mini Shai-Hulud npm supply-chain worm campaign were published.
  • Action: Remove and reinstall dependencies. Audit for signs of compromise if installed during the affected window (v0.1.2 - 0.1.19).

3. guardrails-ai compromise (CVE-2026-45758)

  • Threat: A malicious version of guardrails-ai (0.10.1) was published to PyPI. It has been quarantined.
  • Action: Uninstall guardrails-ai==0.10.1 and reinstall a known good version.

HIGH Severity Highlights

  • Remote Code Execution (RCE): Both Diffusers (CVE-2026-45804) and lmdeploy (CVE-2026-46517) in the AI/ML ecosystem have vulnerabilities allowing for unsafe remote code execution via trust_remote_code bypasses. PenPot MCP (CVE-2026-45805) exposes an unauthenticated /execute endpoint.
  • Denial of Service (DoS): Heavy hitters include u/libp2p**/gossipsub** (Heap exhaustion), u/libp2p**/kad-dht** (Disk exhaustion), and SQLFluff (Parser resource consumption). Update to patched versions to prevent node crashing.
  • SSRF & Injection: Crawlee for Python and SillyTavern both suffer from SSRF vulnerabilities requiring configuration updates. samlify is vulnerable to XML injection leading to privilege escalation in signed SAML assertions.

Automated daily digest, created via https://github.com/Deam0on/wakellm - feedback welcome. Stay safe out there!

reddit.com
u/Deam00n — 5 months ago