News
Vim and GNU Emacs: Claude Code helpfully found zero-day exploits for both
2+ hour, 30+ min ago (611+ words) Developers can spend days using fuzzing tools to find security weaknesses in code. Alternatively, they can simply ask an LLM to do the job for them in seconds. The catch: LLMs are evolving so rapidly that this convenience might come…...
Anthropic employee error exposes Claude Code source
18+ hour, 7+ min ago (362+ words) However, Anthropic spokesperson told CSO, "no sensitive customer data or credentials were involved or exposed. This was a release packaging issue caused by human error, not a security breach. We're rolling out measures to prevent this from happening again." But…...
Attackers trojanize Axios HTTP library in highest-impact npm supply chain attack
18+ hour, 17+ min ago (737+ words) In their analysis, Snyk researchers also noted the sophistication of techniques involved in the attack. Shortly after midnight UTC on March 31 a new version of the Axios package, [email protected], was published on npm followed by [email protected] 39 minutes later. Both listed…...
LangChain path traversal bug adds to input validation woes in AI pipelines
2+ day, 8+ hour ago (436+ words) Security researchers are warning that applications using AI frameworks without proper safeguards can expose sensitive information in basic, yet critical, non-AI ways. According to a recent Cyera analysis, widely used AI orchestration tools, LangChain and LangGraph, are vulnerable to critical…...
Why Kubernetes controllers are the perfect backdoor
4+ day, 23+ hour ago (691+ words) In my years securing cloud-native environments, I've noticed a recurring blind spot. We obsess over the "front doors" such as exposed dashboards, misconfigured RBAC, or unpatched container vulnerabilities. We harden the perimeter, but we often ignore the machinery humming inside....
APIs are the new perimeter: Here’s how CISOs are securing them
1+ week, 4+ day ago (1619+ words) We used to talk about defense-in-depth and endpoint protection," says Sean Murphy, CISO at BECU, a nationwide credit union. That morphed into identity, and now the API is the new perimeter." BECU's backend architecture is heavily based on microservices and…...
Attackers exploit critical Langflow RCE within hours as CISA sounds alarm
6+ day, 7+ hour ago (436+ words) Attackers have exploited a critical Langflow RCE within hours of disclosure, prompting the US Cybersecurity and Infrastructure Security Agency (CISA) to formally flag it for urgent remediation. The flaw, which allows running arbitrary code on vulnerable Langflow instances without credentials,…...
PyPI warns developers after LiteLLM malware found stealing cloud and CI/CD credentials
1+ week, 9+ hour ago (436+ words) PyPI is warning of possible credential theft from AI applications and developer pipelines after two malicious versions of the widely used Python middleware for large language models, LiteLLM, were briefly published. "Anyone who has installed and run the project should…...
AI is breaking traditional security models — Here’s where they fail first
1+ week, 5+ day ago (601+ words) That model held together largely because the speed of decision-making for remediation was traded off at times in favor of fail-fast, disrupt-fast innovation. A structure of coverage using just manual reviews scoped to the code being promised as being shipped,…...
New ‘StoatWaffle’ malware auto‑executes attacks on developers
1+ week, 1+ day ago (253+ words) StoatWaffle is a modular malware implemented by Node.js and it has Stealer and RAT modules," NTT researchers said in a blog post, adding that the campaign operator WaterPlum" is continuously developing new malware and updating existing ones." This means…...