Reader view
Choose the default article length.
Software vulnerabilities, dependencies, and application security.
An integration error routed wallet entropy through MicroPython's deterministic Yasmarang fallback. Updating prevents new weak seeds, but existing ones still require migration.
Read article →A compromised Adform tracking file used browser events, DOM observers and form-field hooks to keep substituting Bitcoin, Ethereum and Tron addresses.
Read article →A crafted image can reach unsafe libvips operations through Active Storage, exposing files and process credentials that a Rails-only update cannot recover.
Read article →A poisoned build can start a memory-resident loader, re-arm through macOS preferences, and seed more projects, Git hooks, and archives.
Read article →On-premises VCO is exposed by default. Arista says defenders must inspect web activity and managed Edge state after patching.
Read article →The flaw reaches an unsafe resource-loading path without AutoType enabled. Exposure is limited to a specific Fastjson 1.x and Spring Boot deployment combination.
Read article →Zenity found URL parameters that preselected a template and auto-submitted instructions inside a logged-in user's Workspace Agents builder.
Read article →Any authenticated proxy-key holder could make two MCP preview endpoints run an arbitrary command on the LiteLLM host.
Read article →The botnet spread through developer extensions and packages, then used stolen credentials to force-push malicious code into default branches.
Read article →CVE-2026-6875 chained query evaluation with a sandbox escape, giving an unauthenticated attacker broad control of a ServiceNow instance and its connected proxy servers.
Read article →Researchers put instructions to read .env and encode it into source inside a PNG that text-only pull-request reviewers ignored but vision-capable coding agents later followed.
Read article →A stolen npm publisher account added a malicious dependency to more than 140 Mastra packages, giving Sapphire Sleet an install-time path into developer and CI systems.
Read article →AIR says its brand-landingpage experiment reached 26,000 agents after scanners missed a remote instruction source that changed after approval.
Read article →Showing 40–52 of 57
