Critical flaw in Protobuf library enables JavaScript code execution

Multiple high-impact security events and active exploitations were reported: a proof-of-concept for a critical remote code execution flaw in protobuf.js was published, enabling JavaScript code execution; CISA warned of active exploitation of a high-severity Apache ActiveMQ vulnerability; a proof-of-concept for a Microsoft Defender zero-day (“RedSun”) that grants SYSTEM privileges was released; recently leaked Windows zero-days are being exploited in the wild; a critical Marimo notebook vulnerability is being abused to deploy NKAbuse malware from Hugging Face; Payouts King ransomware uses QEMU‑