A Mini Shai-Hulud worm spread through more than 400 npm packages, stealing npm, GitHub, cloud, and CI/CD credentials.

Aikido Security says an npm supply chain attack has infected Keyv packages with a variant of the credential-stealing ...

Alibaba’s Qwen team has released Qwen3.8-Max, a 2.4 trillion parameter model with 95 billion active parameters, pitched at ...

Microsoft has added an AI pillar to its Zero Trust Assessment tool and a DevSecOps pillar to its Zero Trust Workshop.

New research from VulnCheck complicates warnings that AI-assisted vulnerability discovery is making exploitation more ...

GitHub Actions will hold potentially malicious workflows until a collaborator with write access approves them.

Flash, a security model built into MDASH that finds vulnerabilities at half the cost of alternatives. Redmond announced the ...

Organisations face a critical challenge: employees are adopting AI and agentic tools at an unprecedented rate, often without IT oversight or governance. While demonstrating a healthy appetite for ...

Amazon Threat Intelligence has tied a DPRK hacking group to four separate npm package supply chain attacks, including axios. The company’s security teams have connected the axios, debug, chalk, and ...

Socket has identified a software supply chain attack involving compromised AsyncAPI npm packages distributing a Miasma botnet loader.

A newly-disclosed exploit in Claude Code’s ‘auto-mode’ leaves developers facing remote code execution (RCE) vulnerabilities during third-party library reviews. The AI Now Institute disclosed a ...

IBM and Red Hat have launched Lightwell to automate vulnerability remediation across enterprise open-source software deployments. The commercial release introduces Lightwell Network and Lightwell ...