Three incidents hit at least nine languages and six Linux distributions in 48 hours. If you’re wondering whether you need to ...

Eight eMudhra intermediate CA keys were compromised, six of them letting anyone who holds them impersonate any website or service. Browsers are already protected. Many non-browser clients are not, and ...

A malicious build of LiteLLM 1.107.0 shipped to PyPI and container registries with Python startup hooks that steal credentials on every interpreter launch, including LiteLLM's own stored provider keys ...

Every campaign has a story behind it. Ours happens to be a bedtime story. Read it to your kids. Read it to a little one in your life. Read it by yourself with a cup of coffee when you just "need a ...

Most AppSec teams don’t lack ambition; they lack a map. Place your program on four levels of AI maturity across two tracks, and learn what to build, what to buy, and where teams stall. AI coding ...

Cursor with Gemini 4 Argon matches Fable 5 at 29% SecPass — tying for the top security score on Cursor — and uniquely solves two tasks no other combo on the leaderboard secures. But it is also the ...

By default, Endor Labs AI SAST and AI Chat send model requests to our provider accounts. With BYOK, those model requests go ...

Partnership Brings Together Reachability-Backed Static Analysis and Runtime Exploit Validation to prioritize and fix ...

Imagine hiring a brilliant security engineer. They’re fast, capable, and eager to help. On day one, you give them access to your source code, GitHub, application security platform, and communication ...

A compromised release of @7nohe/openapi-react-query-codegen runs a dropper on install through three separate triggers, then harvests cloud credentials and republishes itself across npm, RubyGems, and ...

If you added an AI coding agent to your team this year, you have already used an agent harness. Most people just never called it that. An agent harness is the software scaffolding around a large ...

A run of npm supply chain campaigns — Shai-Hulud 2.0 in November 2025 and a series of smaller successors through 2026 — share one technique. A compromised package adds a preinstall script that ...