5 Threats That Reshaped Web Security This Year [2025]

The Hacker News outlines five threats that reshaped web security in 2025. It highlights Vibe Coding, where AI-generated code can be production-ready yet riddled with exploitable flaws, with Base44 authentication bypass on a Wix platform and several CVEs affecting AI coding assistants; July 2025 saw the Base44 flaw patched within 24 hours.

JavaScript injection then surged in March, compromising 150,000+ sites and prompting a 30% rise in CVEs, with attackers exploiting DOM-based XSS and prototype pollution to replace web content. Magecart/E-skimming 2.0 expanded through supply chains, with a 103% rise in attacks in six months and mentions of the cc-analytics domain campaign and large‑scale card data theft from major retailers.

The report also covers AI supply chain attacks, noting a 156% increase in malicious packages and a Shai‑Hulud worm that targeted thousands of npm packages and GitHub repos in 72 hours, evading AI security tools; the Shai-Hulud worm specifically leveraged AI tools to harvest credentials.

Finally, Web Privacy Validation reveals 70% of top US sites drop cookies even when users opt out, exposing compliance risks and fines such as €4.5 million, with continuous validation and data mapping framed as the recommended defence.