Critical flaw in Protobuf library enables JavaScript code execution

Recent BleepingComputer reports cover multiple high‑risk security developments: a critical remote code execution flaw in protobuf.js with public proof‑of‑concept allowing JavaScript code execution; active exploitation of a high‑severity Apache ActiveMQ vulnerability flagged by CISA; several recently leaked Windows zero‑days and a public PoC for a Microsoft Defender “RedSun” zero‑day granting SYSTEM; and an exploited Marimo notebook flaw used to deploy NKAbuse malware from Hugging Face. Other notable items include Payouts King ransomware using hidden QEMU VMs to evade endpoint security, ZionSih