1+ hour, 39+ min ago   (386+ words) The thing that stopped an AI agent from poisoning a public open-source project last month wasn't a firewall, a classifier, or a sandbox. It was one suspicious developer who decided to detonate a strange script in a throwaway container before…...

10+ hour, 13+ min ago   (400+ words) Cloudflare has started handing out wallet handles to its customers, and the pitch sounds like a convenience feature: let your AI agent buy the API it needs without pinging you for a credit card. Read the fine print, though, and…...

11+ hour, 9+ min ago   (701+ words) A self-propagating worm tore through the npm registry on Tuesday morning, trojanizing the widely used keyv and cacheable caching libraries and spreading to more than 400 packages within hours. Wiz Research, Socket, and Microsoft Threat Intelligence are all tracking the campaign,…...

10+ hour, 31+ min ago   (423+ words) For three months, the cPanel security story has been about attackers forcing the front door. The vendor's newest release flips that script: this time, the person holding the keys is a paying customer on the same box as everyone else....

12+ hour, 13+ min ago   (287+ words) The internal source code stolen from GitHub in May is allegedly back on the market, and this time the seller is showing samples to prove it. A listing surfaced today offers what is described as GitHub's internal source code for…...

1+ day, 7+ hour ago   (450+ words) A critical vulnerability in Apple's Screen Sharing service let unauthenticated attackers take over a targeted Mac over the network — reading and writing files as root with no password, no username, and no user interaction. In the researchers' tests, a single…...

1+ day, 9+ hour ago   (1211+ words) Ask any marketer how to track brand mentions in AI search, and you will get the same answer: pick a tool, feed it prompts, and watch the dashboard. Ask a security engineer the same question, and you get a different…...

5+ day, 1+ hour ago   (398+ words) Microsoft has closed a vulnerability chain in Azure Cosmos DB that would have let anyone with a throwaway test account read and write data in every database on the service — including the internal ones behind Entra ID, Teams, and Copilot....

5+ day, 1+ hour ago   (936+ words) For about an hour earlier this year, a working piece of malware sat on PyPI, the public registry that virtually every Python developer pulls from. Fifteen real machines downloaded and executed it. One of them belonged to a security company…...

6+ day, 8+ min ago   (171+ words) cyberkendra.com The server sitting in your company's rack, quietly activating every Windows machine on the network, is about to need a hardware background check Microsoft is rebuilding Key Management Service activation around Trusted Platform Module attestation, and the practical…...