⚡ Weekly Recap: Chrome 0-Day, AI Hacking Tools, DDR5 Bit-Flips, npm Worm & More

The weekly recap focuses on a rapid-fire threat landscape, led by Google patches for Chrome including CVE-2025-10585, a zero-day described as a type confusion in V8 that has been exploited in the wild. It also highlights a wave of AI and supply‑chain concerns, from Villager, an AI‑native pen‑testing tool with about 11,000 PyPI downloads, to a self‑replicating worm hitting npm, affecting over 500 packages.

Other notable items include a RowHammer attack against DDR5 RAM called Phoenix, which enables controlled memory modification, and a Windows SCM‑based lateral movement technique that uses service configurations for stealthy execution. The roundup also covers law enforcement actions such as the U.K. arrests of two Scattered Spider members linked to the TfL attack and the RCMP seizure of TradeOgre, along with warnings about phishing ecosystems like VoidProxy PhaaS and IaaS abuse surrounding cloud services.

These entries illustrate how attackers reuse proven tactics amid emerging technologies, with defensive lessons emphasised for patching, monitoring, and supply‑chain hygiene, according to The Hacker News.