isolated-vm Sandbox Escape Flaw Enables Host RCE in All Versions ≤7.0.0

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Plan: Any Node.js service using isolated-vm to run untrusted code (plugins, user-submitted scripts, multi-tenant eval) is exposed to host RCE; no public PoC or KEV listing yet, but the impact ceiling is high — audit your dependency tree and upgrade isolated-vm to a version above 7.0.0 this sprint.
SOC/IR — Skip
Leader — Skip

Malvertising campaign assembles malware in browser memory via JS

Sun, 26 Jul 2026 12:14:17 +0000

Engineer — Learn: This technique—assembling malware entirely within browser memory via JavaScript—bypasses file-based detection and signals a shift in delivery model worth factoring into client-side defense strategies (CSP hardening, browser isolation). No specific software to patch; no KEV or PoC signals.
SOC/IR — Plan: The campaign is described as large-scale and targets users of crypto/trading sites; build or tune EDR behavioral rules for in-browser memory injection and anomalous JS execution patterns this quarter. The summary provides no specific IOCs to hunt on immediately.
Leader — Skip