ThreatsDay Bulletin: Smart TV Proxyware, 24-Year curl Bug, AI Crime Forums + 13 More Stories

This week's threat roundup exposes how vulnerabilities spanning decades — like the 24-year-old curl memory flaw — persist in production environments due to inadequate patch lifecycle management and poor dependency tracking. The discovery of residential proxy SDKs silently embedded in LG and Samsung smart TV apps illustrates how third-party supply chain components can introduce covert threats that bypass traditional perimeter defenses. The unauthenticated takeover flaw in Hoppscotch (CVE-2026-50160) underscores the danger of internet-exposed developer tools left unpatched and misconfigured. Collectively, these incidents reflect a systemic failure to audit software supply chains, maintain current patch levels, and enforce least-privilege access on critical platforms. Organizations that treat security patching as optional or episodic — rather than continuous — remain easy targets for both opportunistic and sophisticated threat actors.