A Mini Shai-Hulud worm spread through more than 400 npm packages, stealing npm, GitHub, cloud, and CI/CD credentials.

Aikido Security says an npm supply chain attack has infected Keyv packages with a variant of the credential-stealing ...

Alibaba’s Qwen team has released Qwen3.8-Max, a 2.4 trillion parameter model with 95 billion active parameters, pitched at ...

Microsoft has added an AI pillar to its Zero Trust Assessment tool and a DevSecOps pillar to its Zero Trust Workshop.

GitHub Actions will hold potentially malicious workflows until a collaborator with write access approves them.

New research from VulnCheck complicates warnings that AI-assisted vulnerability discovery is making exploitation more ...

Flash, a security model built into MDASH that finds vulnerabilities at half the cost of alternatives. Redmond announced the ...

Organisations face a critical challenge: employees are adopting AI and agentic tools at an unprecedented rate, often without IT oversight or governance. While demonstrating a healthy appetite for ...

Amazon Threat Intelligence has tied a DPRK hacking group to four separate npm package supply chain attacks, including axios. The company’s security teams have connected the axios, debug, chalk, and ...

As the world races towards 2025, Developer examines what lies ahead for software development in the new year. Among the most pressing trends for 2025 are AI development simplification, the integration ...

A new group of major firms, the Open Secure AI Alliance, are setting out to build open-source AI tools for security defences.

Google has introduced subagents into the Gemini CLI, turning the traditional terminal into a multi-agent dispatch centre. Developers can now summon specialised expert agents straight from the terminal ...