#scripts


Brevo supply-chain attack injected ClickFix scripts on customer sites

Sep 17, 2026 // 20:17

Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on […]

AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure

Aug 20, 2026 // 23:44

The U.S. government on Wednesday warned of an “active threat” targeting critical infrastructure organizations in the country using artificial intelligence (AI)-generated exploit scripts. The activity […]

npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk

Jul 9, 2026 // 19:55

GitHub has officially announced the release of npm version 12 with install scripts disabled by default, along with deprecating granular access tokens (GATs) designed to […]

The Scripts on Your Checkout Page Are Now a PCI DSS Problem

Jun 18, 2026 // 14:01

An independent PCI assessor tested Reflectiz against the new PCI DSS rules. Here is the verdict: See the full QSA assessment here → When a […]

Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors on Sites

Jun 15, 2026 // 22:50

An attacker tampered with trusted JavaScript files used by WordPress sites running PushEngage, OptinMonster, and TrustPulse, turning those files into a way to break into […]

GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks

Jun 11, 2026 // 10:17

GitHub has announced what it said are “breaking changes” coming to npm version 12, one of which turns off install scripts by default to combat […]

LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root

May 23, 2026 // 10:48

A maximum-severity security vulnerability impacting LiteSpeed User-End cPanel Plugin has come under active exploitation in the wild. The flaw, tracked as CVE-2026-48172 (CVSS score: 10.0), […]

LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root

May 23, 2026 // 10:46

A maximum-severity security vulnerability impacting LiteSpeed User-End cPanel Plugin has come under active exploitation in the wild. The flaw, tracked as CVE-2026-48172 (CVSS score: 10.0), […]

Signed software abused to deploy antivirus-killing scripts

Apr 15, 2026 // 21:17

A digitally signed adware tool has deployed payloads running with SYSTEM privileges that disabled antivirus protections on thousands of endpoints, some in the educational, utilities, […]