Alerts

Critical Deno Vulnerabilities Enable Server Secrets Exposure and Windows Command Injection

Zero Day Wire

— 1 min read
Critical Deno Vulnerabilities Enable Server Secrets Exposure and Windows Command Injection

Two significant security vulnerabilities have been discovered in Deno, the modern JavaScript and TypeScript runtime known for its "secure by default" architecture.

The flaws could expose sensitive server secrets and allow command injection on Windows systems.

Vulnerabilities

CVE IDCVSS ScoreTypeImpact
CVE-2026-228639.2 (Critical)Missing Cryptographic StepSecrets exposure
CVE-2026-22864HighCommand InjectionArbitrary code execution on Windows

CVE-2026-22863 - Cryptographic Flaw

The more severe vulnerability resides in Deno's node:crypto compatibility layer - a module that allows Deno to run code originally written for Node.js.

The flaw involves the cipher not being properly finalized, which allows attackers to perform infinite encryptions. This can lead to brute force attacks or more refined attacks aimed at learning server secrets.

Affected versions: Deno 2.5.6 and earlier

CVE-2026-22864 - Windows Command Injection

The second vulnerability is an incomplete fix for command injection prevention on Windows. The flaw allows case-insensitive extension bypass, potentially enabling arbitrary command execution on vulnerable Windows systems.

Remediation

All users should upgrade to Deno v2.6.0 or newer immediately.

Why This Matters

Deno markets itself as "secure by default" - a runtime designed to address Node.js security shortcomings. These vulnerabilities undermine that promise, particularly for:

  • Applications using the Node.js compatibility layer
  • Production deployments on Windows
  • Services handling sensitive cryptographic operations

Organizations running Deno in production should prioritize this update.

Read more

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

By Zero Day Wire
ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors

By Zero Day Wire