Cybersecurity
353 articles RSS
Malicious npm Package Bypasses Install-Script Defenses, Hides Malware Inside Runtime Code
The indexed-btree npm package evades npm v12's install-script blocking by hiding its malware loader inside a runtime method instead, Checkmarx reports.
PolinRider Campaign Hits Packagist, Planting Malware in a 700,000-Download Laravel Nova Package
Socket found malicious code in dev branches of a 700,000-download Laravel Nova package on Packagist, tying the compromise to its ongoing PolinRider campaign.
Rust Security Team Warns of Targeted Social-Engineering Campaign Against Prominent Developers
The Rust security response working group and crates.io team warn that rust-lang members and popular crate owners are being lured into fake video calls to compromise their devices and accounts.
GemStuffer Campaign Exploited RubyGems' Documentation-Build Pipeline for RCE and a CVSS 7.3 CDN Caching Flaw
A research report ties a May 2026 RubyGems package-flooding campaign to OpenAI agents that abused a documentation-build RCE and probed a since-patched CDN key-leak bug.
GitHub Security Lab Finds Same-Second Race Condition in JupyterLab CI Action That Enables Code Execution
A TOCTOU race in JupyterLab's update-snapshots-checkout GitHub Action let a same-second commit push bypass its authorization check and reach attacker-controlled code execution, GitHub Security Lab found.
Rustls 0.23.44 Enables Post-Quantum ML-DSA Certificates by Default in AWS-LC-RS Provider
Rustls's September 7 release turns on NIST-standardized ML-DSA post-quantum certificates by default for the aws-lc-rs provider, plus a KeyLogFile permissions fix and an ECH certificate-verification fix.
vlt Reaches 1.0, Launching Hosted Package Registries as a Security-First npm Replacement
vlt, a JavaScript package manager built by npm's original developers, ships 1.0 with hosted registries that block malware and phased installs that stop scripts from running automatically.
Attackers Exploit Critical JFrog Artifactory Auth-Bypass Flaw Within Days of Patch
CISA added CVE-2026-82329, a 9.8-severity Artifactory authentication bypass, to its exploited-vulnerabilities catalog days after JFrog patched it.
GitSpawn Flaws Let Malicious .git Configs Run Attacker Code in Claude Code, Cursor, Codex, and Other AI Coding Agents
Manifold Security found eight flaws across seven AI coding agents that let a repository's git config silently execute code the moment it is opened.
IssueTrojanBench Study Finds Malicious GitHub Issues Bypass AI Coding Agent Guardrails Up to 79% of the Time
A Concordia University benchmark found Cursor, Claude Code, and Codex Desktop let malicious GitHub issues bypass their safety guardrails in up to 79.2% of attempts, with GPT-based agents far more vulnerable than Claude Code.
Contrast Security Report Finds AI Application-Security Scanners Agree on Just 5% of Findings
Three AI-powered AppSec scanners run on the same codebase agreed on only 5% of findings, and one scanner reproduced just 17% of its own results on repeat runs, Contrast Security's AppSec Overflow 2026 report finds.
Australia Charges Two Men With 14 Offenses Over TeamPCP's Supply-Chain Hacking Spree That Hit Trivy, LiteLLM and GitHub
AFP, FBI and WA Police charged a 21-year-old and a 23-year-old over the TeamPCP campaign that compromised 1,000+ organizations through open-source developer tools.