Fawzan (@eFawzan) header
Fawzan (@eFawzan) profile picture

Fawzan

@eFawzan

Computer Engineer | Founder of Lockhound (https://teapawt.net/t.co/0cYLroaq70) Building tools that make software safer, one dependency at a time.

 Dubai, United Arab Emirates
Joined May 2011
  • Tweets5.5K
  • Following343
  • Followers715
393Media
Photo by Fawzan (@eFawzan)Photo by Fawzan (@eFawzan)Photo by Fawzan (@eFawzan)Photo by Fawzan (@eFawzan)Photo by Fawzan (@eFawzan)Photo by Fawzan (@eFawzan)Photo by Fawzan (@eFawzan)Photo by Fawzan (@eFawzan)Photo by Fawzan (@eFawzan)Photo by Fawzan (@eFawzan)
Top 5 dependency vulnerabilities to fix (Nov 11): 1. mongoose (npm): critical, fix 9.11.4 2. node-forge (npm): high, fix 1.4.3 3. react-server-dom-webpack (npm): critical, fix 19.3.1 4. rack (Ruby): high, fix 3.2.8 lockhound.app/daily/2026-11-…
Dependency vulnerabilities to fix, Nov 11, 2026 · Lockhound

Dependency vulnerabilities to fix, Nov 11, 2026 · Lockhound

mongoose, node-forge and more: the dependency vulnerabilities most worth fixing on Nov 11, 2026, ranked by exploitation, severity and reach.

lockhound.app
3
63
Theo's behavior should be condemned by the tech community. PERIOD.
Kyle Gawley (@kylegawley) profile pictureKyle Gawley
@kylegawleyNov 11
There is no place for misogynistic behaviour in tech. Sadly women have to deal with this kind of thing too often in tech and it should be called out.
3
45
No high-impact dependency advisories today (Nov 8). lockhound.app/daily/2026-11-…
Dependency vulnerabilities to fix, Nov 8, 2026 · Lockhound

Dependency vulnerabilities to fix, Nov 8, 2026 · Lockhound

The dependency vulnerabilities most worth fixing on Nov 8, 2026, ranked by exploitation, severity and reach.

lockhound.app
39
Top 5 dependency vulnerabilities to fix (Nov 7): 1. github.com/canonical/lxd (Go): critical, fix 0.0.0-20261005133302-c4a919f3f4e2 2. github.com/osac-project/osac… (Go): high, fix 0.0.4 3. GeoNode (Python): high, fix 5.1.0 lockhound.app/daily/2026-11-…
GitHub - canonical/lxd: Powerful system container and virtual machine manager

GitHub - canonical/lxd: Powerful system container and virtual machine manager

Powerful system container and virtual machine manager - canonical/lxd

github.com
39
Lockhound gives each repo a grade from A+ to F. F = a malicious package D = a known-exploited CVE C = critical B = high A = medium/low only A+ = nothing found Try it free on 5 private repos: lockhound.app
1
61
AI coding tools sometimes suggest package names that don't exist. Attackers register those names and wait. It's called slopsquatting. Lockhound's MCP server lets your agent check a package before it installs it. Now on every paid plan. lockhound.app/
Lockhound: dependency vulnerability monitoring for GitHub

Lockhound: dependency vulnerability monitoring for GitHub

Find the vulnerable, exploited and malicious dependencies in every GitHub repository, ranked by what to fix first, with a check on every pull request.

lockhound.app
36
Top 3 dependency vulnerabilities to fix (Nov 5): 1. @payloadcms/storage-vercel-blob (npm): medium, fix 4.0.0-canary.34 2. github.com/basekick-labs/arc (Go): medium, fix 0.0.0-20260610131716-5dc8f53b70a3 3. odf-kit (npm): medium, fix 0.14.2 lockhound.app/daily/2026-11-…
38
Critical Ruby on Rails vulnerability (GHSA-f3w6-w445-fwh9) carries a CVSS score of 9.8. It allows unauthenticated attackers to read and write arbitrary files through ImageMagick processing in Active Storage. A crafted upload can trigger the vulnerability without requiring authentication. Patch immediately: - Rails 8.1.4.1 - Rails 8.0.5.2 Applications accepting untrusted uploads should prioritize this update.
1
5
10
1,179
🚨 Attackers are targeting an unpatched CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin. CVE-2026-81648 can let unauthenticated attackers extract wallet credentials, delete server files, and overwrite payment settings. No known fix. Exploitation attempts observed in the wild. Full details ↓ thehackernews.com/2026/11/at…
Image from The Hacker News (@TheHackersNews)
15
60
4
183
41,183
🚨 WordPress Core flaw under active exploitation. CISA confirms attacks targeting CVE-2026-119977, a high-severity race condition that can allow unauthenticated code execution during core upgrades. Over 12,600 exploit attempts blocked in 24 hours. Details: thehackernews.com/2026/11/ci…
Image from The Hacker News (@TheHackersNews)
58
187
34
700
83,111
🚨 Node.js warns of HIGH-severity security vulnerabilities. Security fixes are coming November 11 for Node.js 26.x, 24.x, and 22.x. All three release lines are affected. Production users should take note. Details: nodejs.org/en/blog/vulnerabi…
Image from The Hacker News (@TheHackersNews)
72
465
203
2,005
511,814
Dear @ubuntu, A critical kernel vulnerability with a CVSS score above 9.8 remains unpatched. Debian fixed it on October 16, and Omarchy and several other distros have already followed. For a company promising “Enterprise resilience,” this is unacceptable. ubuntu.com/security/CVE-2026…
CVE-2026-98432 | Ubuntu

CVE-2026-98432 | Ubuntu

Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things.

ubuntu.com
4
4
3
61
3,325
Important read if you care about security of your projects. Another "horror story" from Reddit. A worm used a stolen GitHub token to rewrite commits in 58 repos, and ran on our Forge servers during deploy. What happened and what we changed : r/laravel reddit.com/r/laravel/comment…
From the laravel community on Reddit

From the laravel community on Reddit

Explore this post and more from the laravel community

reddit.com
1
12
59
11,982
Good time to signup for a trial. lockhound.app
Lockhound: dependency vulnerability monitoring for GitHub

Lockhound: dependency vulnerability monitoring for GitHub

Find the vulnerable, exploited and malicious dependencies in every GitHub repository, ranked by what to fix first, with a check on every pull request.

lockhound.app
The Hacker News (@TheHackersNews) profile pictureThe Hacker News
@TheHackersNewsNov 4
🚨 Node.js warns of HIGH-severity security vulnerabilities. Security fixes are coming November 11 for Node.js 26.x, 24.x, and 22.x. All three release lines are affected. Production users should take note. Details: nodejs.org/en/blog/vulnerabi…
Image from The Hacker News (@TheHackersNews)
1
3
`npm audit` on an old project: 87 vulnerabilities. How many matter this week? Usually a handful. Here's how to find them 🧵
1
1
81
CVSS = how bad it could be. CISA KEV = attackers are using it now. FIRST EPSS = how likely it is to be exploited soon. You want all three.
3
1
69
Commands for all of this (curl + jq, no product needed): lockhound.app/guides/priorit… We automate it across GitHub repos at lockhound.app. Try a lockfile at lockhound.app/check.
Prioritise vulnerabilities with CISA KEV and EPSS · Lockhound

Prioritise vulnerabilities with CISA KEV and EPSS · Lockhound

CVSS says how bad a vulnerability could be, not whether anyone exploits it. Add CISA's KEV catalog and EPSS scores to your triage, with commands to run today.

lockhound.app
1
29
Bonus trap: the "fixed in" version can still be vulnerable. Log4j 2.15.0 fixed Log4Shell and still had CVE-2021-45046.
14
Order: malicious packages → KEV-listed CVEs → critical/high in production deps → the rest by EPSS. A medium bug under active exploitation beats a 9.8 in your test runner.
1
Top 4 dependency vulnerabilities to fix (Nov 4): 1. github.com/mtzanidakis/prakt… (Go): high, fix 0.9.1 2. stanza (Python): high, fix 1.15.0 3. org.keycloak:keycloak-services (Java): high, fix 26.6.4 lockhound.app/daily/2026-11-…
GitHub - mtzanidakis/praktor: Multi-agent Claude Code orchestrator with Telegram I/O, Docker...

GitHub - mtzanidakis/praktor: Multi-agent Claude Code orchestrator with Telegram I/O, Docker...

Multi-agent Claude Code orchestrator with Telegram I/O, Docker isolation, swarm patterns, and Mission Control UI - mtzanidakis/praktor

github.com
46
Load more