The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake ...

Malicious npm package indexed-btree hid its loader in runtime code, avoiding install hooks after logging millions of downloads.

The NPM ecosystem has suffered another supply chain attack in which a malicious package has accumulated millions of downloads ...

GitHub's npm registry shipped staged publishing in May 2026, the first mandatory 2FA human checkpoint in its 16-year history, ...

Google PageBreak found over 500 verified XSS flaws across company web apps and plans closer CodeMender integration for code ...

The Chinese-speaking operator used three different open source AI harnesses - Strix, Cairn, and Hermes - to run the ...

GNOME 50.5 security fixes patch a gvfs CVE, Epiphany code injection and ZIP slip flaw, and a librsvg use-after-free. Upgrade ...

Gambit Security found AI agents breached 27 companies, stole 600,000 credit card records and installed payment skimmers ...

A threat actor is using three AI harnesses for vulnerability research, exploitation, and attack orchestration.

OpenAI fixed two Codex sandbox escape vulnerabilities after researchers showed how malicious code could bypass key security restrictions.

Malicious Terraform providers and Go modules deliver Graphalgo-linked Go malware using blockchain and Slack for command and ...

A financially motivated threat actor is using open-source AI agent frameworks to attack hundreds of online retailers at scale, stealing more than 600,000 credit card records.