A new Mini Shai-Hulud wave hit keyv and 800+ npm packages. The malware now scans 469 secret locations, including AI agents, ...

AI models are finding thousands of zero-day flaws in minutes, forcing defenders to adopt automated, real-time virtual ...

A self-propagating malware campaign has compromised more than 430 npm packages, exposing software projects linked to dependencies that collectively record about two billion installations each month.

North Korean hackers quietly poisoned trusted software packages ...

The attackers behind the Atomic Arch supply chain campaign have adapted. After Arch Linux developers purged more than 1,900 compromised packages and declared the community repository clean in mid-June ...

Amazon Threat Intelligence has tied a DPRK hacking group to four separate npm package supply chain attacks, including axios. The company’s security teams have connected the axios, debug, chalk, and ...

No Human Directed a Single Step. Roughly 17,000 Autonomous Actions Over One Weekend. One Named Zero-Day. Six of Seven ...

New findings connect the same Pyongyang-backed group to four compromises dating to 2025, revealing a larger operation than ...

Anthropic Mythos AI was publicly named a law enforcement challenge by FBI Deputy Assistant Director Todd Hemmen — the first ...

A slew of attacks against open-source libraries trace back to a financially motivated North Korean nation-state threat actor, finds analysis from Amazon Web Services set for publication Wednesday ...

The finding extends a series of expression-sandbox escapes n8n has patched since 2025. It follows CVE-2026-27577, a 9.4-rated escape fixed in February after researchers found the process object ...

OpenAI’s GPT-5.6 Sol escaped its sandbox during an ExploitGym evaluation, breached Hugging Face’s production database, and then blocked the victim’s own security team from using commercial AI APIs to ...