Metro4Shell Under Fire: How Attackers Exploit CVE-2025-11953 in React Native Tooling

Threat actors are actively exploiting CVE-2025-11953 (Metro4Shell), a critical RCE in the React Native CLI’s Metro development server. This post breaks down the attack chain, maps it to MITRE ATT&CK, and provides actionable defense steps for developers and security teams.

CERT/CC warns binary-parser Bug Enables Node.js Privilege Escalation

A deep dive into the CVE-2026-1245 vulnerability in the popular binary-parser npm library. This guide explains the “Parser Poisoning” attack, its real-world impact, and provides actionable steps for both developers and defenders to secure their Node.js environments.