Cybernews

Hackers can exploit thousands of exposed Google API keys to access Gemini and steal data

Exposed Google API keys previously not considered secrets can now inadvertently grant attackers access to sensitive Gemini ...

Deno 2.7 sharpens Node.js compatibility and stabilizes Temporal

Version 2.7 of the runtime for JavaScript and TypeScript stabilizes the Temporal API, introduces npm overrides, and ...

XSS攻撃の温床「innerHTML」はもう終わり、「Firefox 148」に「setHTML ...

先日リリースされた「Firefox 148」には、主要Webブラウザーで初めて「Sanitizer API」が実装されているとのこと。「クロスサイトスクリプティング」と呼ばれるタイプの脆弱性を抑制する技術として期待されており、他のWebブラウザーも追随する見込みだ。
InfoWorld

Abandoned project linking Java, JavaScript makes a comeback

The Detroit project envisioned using JavaScript as an extension language for Java applications. Now it’s being revived with ...
Microsoft

Developer-targeting campaign using malicious Next.js repositories

A developer-targeting campaign leveraged malicious Next.js repositories to trigger a covert RCE-to-C2 chain through standard ...
The Hacker News

Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens

The module targets Claude Code, Claude Desktop, Cursor, Microsoft Visual Studio Code (VS Code) Continue, and Windsurf. It also harvests API keys for nine large language models (LLM) providers: ...