Critical flaw in Protobuf library enables JavaScript code execution

Multiple high-risk vulnerabilities and active exploits were reported: a proof-of-concept for a critical remote-code-execution flaw in protobuf.js (JavaScript) has been published; CISA flagged a high-severity Apache ActiveMQ flaw as actively exploited; a PoC for a Microsoft Defender zero-day dubbed “RedSun” grants SYSTEM privileges; and recently leaked Windows zero-days are being used to gain elevated/system privileges. Additional incidents include exploitation of a critical Marimo flaw to deploy NKAbuse malware from Hugging Face, Payouts King ransomware using hidden QEMU VMs to evade endpoint/