Updated continuously
This week's top 10 website threats
The attacks that matter for website owners right now, ranked by how active they are and how directly they can hit a website. Enter your domain to get a verdict on each one in a few seconds.
The list
Ranking reviewed · malware feed synced every 6 hours-
01
This week's malicious npm packages
520 npm packages flagged as malware in the last 48 hours, plus every older malicious version on record
-
02
Collabora Built-in CODE Server for Nextcloud exploited to plant web shells
Nextcloud office add-on exploited to plant web shells; CISA lists it as exploited (Oct 23)
-
03
Arista VeloCloud Orchestrator SQL injection exploited as a zero-day
Network orchestrator zero-day lets read-only users take over; exploited (Oct 22)
-
04
LiteLLM 1.107.0 release-pipeline compromise
Backdoored release of a popular AI gateway steals server credentials (Oct 21)
-
05
Cisco Secure Email Gateway file-write flaw under active attack
Email security appliance flaw lets attackers write files; under active attack (Oct 14)
-
06
Rank Math SEO PRO 3.0.123 backdoored at the vendor
Backdoored WordPress SEO plugin shipped from the vendor (Oct 15–16)
-
07
Stolen UpdraftCentral keys used to plant backdoor plugins
Stolen backup-dashboard keys used to plant backdoor plugins (Oct 18–19)
-
08
Shopify apps turned into checkout phishing redirects (HulkApps, Selleasy, Swym)
Shopify app settings injected a fake-checkout redirect that steals cards (Oct 10–16)
-
09
eMudhra / emSign intermediate certificate keys compromised
Certificate authority keys compromised; browsers distrust the certificates (Oct 17–20)
-
10
polyfill.io CDN takeover
Hijacked script CDN still referenced by many sites (since 2024)
How we pick and check them
We track supply-chain attacks, backdoored plugins and certificate problems as they're disclosed, verify each one against vendor and primary sources, and rank the ones most likely to affect a website today. Older attacks stay on the list while they're still commonly found on live sites.
The first item uses live lookups: identifiable package names and exact versions from inspected public resources are checked against public malware databases at the moment you check. Bundled or hidden dependencies may not be identifiable.
Some attacks only touch servers and build machines. Those are labelled "Outside scan scope," with steps to check your own systems. Each threat links to its full write-up in the incident tracker.
When something can't be checked, because a lookup failed, a version isn't visible or a page couldn't be read, the result says "Unable to assess" rather than guessing. And no evidence on the pages we can see isn't proof a site is unaffected: code behind a login or on the server isn't visible to any outside scan.