Securely execute Node.js workloads in WebAssembly sandboxes – that is the goal of the new JavaScript runtime Edge.js.

The bug was assigned CVE-2025-2135, and we successfully used it to pwn Google’s V8CTF as a zero-day. The root cause lies in TurboFan’s InferMapsUnsafe() function, which fails to handle aliasing when ...

The OpenJS Foundation has launched a new program to support companies in switching to current Node.js versions.

A newly identified malicious implant named RoadK1ll is enabling threat actors to quietly move from a compromised host to ...

Valentić told The Hacker News that the use of fake progress indicators mimicking legitimate installation progress and the ...

The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, ...

North Korean hackers exploit VS Code tasks.json auto-run since Dec 2025 to deploy StoatWaffle malware, stealing data and ...

The newly observed malware abuses VS Code’s “runOn:folderOpen” feature to execute automatically from trusted projects, ...

The most notable development is the use of a technique known as EtherHiding, which stores C2 addresses inside Ethereum smart ...

JavaOne Oracle has shipped Java 26, a short-term release, and introduced Project Detroit, which promises faster interop ...