Red Hat’s npm repository has been hit by a supply chain attack in which hackers published 32 malicious package versions to steal credentials and secrets from developer machines and deliver a self-propagating worm.
This incident is the latest in a string of supply chain attacks targeting open-source systems in recent months.

Dashlane password manager has reported that a large-scale brute-force attack targeted user accounts on May 31, 2026. An unknown attacker tried to bypass two-factor authentication (2FA) by repeatedly guessing authentication codes in order to register unauthorized devices on users’ accounts. The attackers succeeded in downloading encrypted vault data from fewer than 20 users.

Microsoft has softened its position, easing concerns about possible legal action against researchers and reaffirming its support for coordinated vulnerability disclosure.
This comes after facing criticism from the security research community following the controversy involving Nightmare Eclipse, a researcher who publicly released functional proof-of-concept exploits for six Windows vulnerabilities. Three of those vulnerabilities were later exploited in real-world attacks.