DevSecOps

NPM ecosystem hit with two new supply chain compromises

Stolen and leaked credentials lead to Node.js packages from AsyncAPI and Jscrambler Code Integrity being poisoned with malware.

AI coding tool hole illustrates a big problem with human in the loop

The flaw, which impacted Amazon, Anthropic, Google, Cursor and others, let the agent give the human false information on which to make decisions.

GitHub's public APIs are becoming an enterprise reconnaissance tool

Researchers have uncovered a sustained campaign using GitHub's public APIs and ghost accounts to profile enterprise software environments while blending into normal developer activity.

Argo CD flaw shows why GitOps infrastructure should be treated as tier zero

The unpatched vulnerability could give attackers a pathway from a compromised pod to broader control over Kubernetes deployments.

Get a Jump on Reducing Your Open Source Software Security Risks

Sandbox bypass flaws in Cursor IDE highlight prompt injection as an RCE vector

The two vulnerabilities reveal a native flaw in LLMs and AI-assisted IDEs affecting more than just Cursor.

Hole in widely-used FFmpeg codec could crash media servers or enable RCE

Research from JFrog into the software supply chain vulnerability points to the need for better visibility into applications, including SBOMs.