Cyber Attacks
1.0.3 imgdecode npm package hosts hidden shellcode loader, 979 downloads, still online
The imgdecode package, version 1.0.3, hides a shellcode loader in a Windows addon. The package remains available on npm with no confirmed removal.
Windows
Everything Patch Herald has reported about Windows: 2 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Microsoft Patches High-Severity .NET WPF OOB Write Affecting Versions 8 Through 11 on Windows
Microsoft has released updates for CVE-2026-96224, a high-severity out-of-bounds write in .NET WPF that allows remote code execution.