research hub

Security research,
plainly explained

New analyses every week — vulnerabilities, exploits, and the attack patterns that matter. What the bug is, who's exposed, what to do about it before Monday.

CVE-2026-5760: RCE via malicious GGUF model files in SGLang

April 22, 2026 CVE

CVE-2026-5760: RCE via malicious GGUF model files in SGLang

CVE-2026-5281: Chrome zero-day in Dawn/WebGPU under active exploitation

April 22, 2026 CVE

CVE-2026-5281: Chrome zero-day in Dawn/WebGPU under active exploitation

Checkmarx KICS Docker images and VS Code extensions (TeamPCP): mcpAddon.js multi-cloud stealer, orphan commit staging, GitHub Actions workflow injection

April 22, 2026 Threat intel

Checkmarx KICS Docker images and VS Code extensions (TeamPCP): mcpAddon.js multi-cloud stealer, orphan commit staging, GitHub Actions workflow injection

axios compromised on npm: account takeover drops cross-platform RAT across 25 million weekly downloads

March 31, 2026 Threat intel

axios compromised on npm: account takeover drops cross-platform RAT across 25 million weekly downloads