Skip to content

malwarechronicle

Breaking

Patch nodejs-whisper to Block OS Command Injection in Audio Processing
Patch .NET Core 8-11 to Fix High-Severity DoS in DateTime Parsing
Patch .NET 8-11 on Unix to stop local symlink attacks from elevating privileges
Update ASP.NET Core 8-11 to Block Unauthenticated DoS via Synthetic Culture Names in Localization Logic
Screen Remote Devs: 14 Indicted in NK Scheme Using Stolen IDs to Infiltrate 70 US Firms
Upgrade .NET 8, 9, 10 Negotiate Auth to 8.0.32, 9.0.21, 10.0.13 to Stop LDAP Spoofing
Patch nodejs-whisper to Block OS Command Injection in Audio Processing
Patch .NET Core 8-11 to Fix High-Severity DoS in DateTime Parsing
Patch .NET 8-11 on Unix to stop local symlink attacks from elevating privileges
Update ASP.NET Core 8-11 to Block Unauthenticated DoS via Synthetic Culture Names in Localization Logic
Screen Remote Devs: 14 Indicted in NK Scheme Using Stolen IDs to Infiltrate 70 US Firms
Upgrade .NET 8, 9, 10 Negotiate Auth to 8.0.32, 9.0.21, 10.0.13 to Stop LDAP Spoofing

OS command injection

Everything Malware Chronicle has reported about OS command injection: 2 stories, newest first. Part of our Vulnerabilities coverage.

14 Oct
Vulnerabilities

Patch nodejs-whisper to Block OS Command Injection in Audio Processing

A critical flaw in the nodejs-whisper library allows attackers to execute arbitrary system commands via manipulated audio file paths.

09 Oct
Vulnerabilities

Update Dromara Skyeye Now: Critical CVE-2026-107780 Enables Unauthenticated Windows Command Execution

A critical flaw in Dromara Skyeye allows attackers to run commands via an unauthenticated TTS endpoint, risking full system compromise on Windows.