News
OpenAI Patches ChatGPT Data Exfiltration Flaw and Codex GitHub Token Vulnerability
2+ hour, 3+ min ago (906+ words) A previously unknown vulnerability in OpenAI ChatGPT allowed sensitive conversation data to be exfiltrated without user knowledge or consent, according to new findings from Check Point. "A single malicious prompt could turn an otherwise ordinary conversation into a covert exfiltration…...
Google News
7+ hour, 8+ min ago (11+ words) 3 SOC Process Fixes That Unlock Tier 1 Productivity'The Hacker News...
The State of Secrets Sprawl 2026: 9 Takeaways for CISOs
8+ hour, 38+ min ago (295+ words) Secrets sprawl isn't slowing down: in 2025, it accelerated faster than most security teams anticipated. GitGuardian's State of Secrets Sprawl 2026 report analyzed billions of commits across public GitHub and uncovered 29 million new hardcoded secrets in 2025 alone, a 34% increase year over year…...
TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files
3+ day, 3+ hour ago (812+ words) TeamPCP, the threat actor behind the supply chain attack targeting Trivy, KICS, and litellm, has now compromised the telnyx Python package by pushing two malicious versions to steal sensitive data. The two versions, 4.87.1 and 4.87.2, published to the Python Package Index…...
Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks
3+ day, 6+ hour ago (500+ words) Cybersecurity researchers have disclosed details of a now-patched bug impacting Open VSX's pre-publish scanning pipeline to cause the tool to allow a malicious Microsoft Visual Studio Code (VS Code) extension to pass the vetting process and go live in the…...
LangChain, LangGraph Flaws Expose Files, Secrets, Databases in Widely Used AI Frameworks
3+ day, 12+ hour ago (203+ words) The issues, in a nutshell, offer three independent paths that an attacker can leverage to drain sensitive data from any enterprise LangChain deployment. Details of the vulnerabilities are as follows - Successful exploitation of the aforementioned flaws could allow an attacker…...
TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 Likely via Trivy CI/CD Compromise
6+ day, 1+ hour ago (719+ words) TeamPCP, the threat actor behind the recent compromises of Trivy and KICS, has now compromised a popular Python package named litellm, pushing two malicious versions containing a credential harvester, a Kubernetes lateral movement toolkit, and a persistent backdoor. Multiple security…...
Ghost Campaign Uses 7 npm Packages to Steal Crypto Wallets and Credentials
6+ day, 8+ hour ago (664+ words) Cybersecurity researchers have uncovered a new set of malicious npm packages that are designed to steal cryptocurrency wallets and sensitive data. The activity is being tracked by ReversingLabs as the Ghost campaign. The list of identified packages, all published by…...
North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware
1+ week, 1+ hour ago (842+ words) The North Korean threat actors behind the Contagious Interview campaign, also tracked as WaterPlum, have been attributed to a malware family tracked as StoatWaffle that's distributed via malicious Microsoft Visual Studio Code (VS Code) projects. The use of VS Code…...
We Found Eight Attack Vectors Inside AWS Bedrock. Here's What Attackers Can Do with Them
1+ week, 14+ hour ago (212+ words) AWS Bedrock is Amazon's platform for building AI-powered applications. It gives developers access to foundation models and the tools to connect those models directly to enterprise data and systems. That connectivity is what makes it powerful " but it's also what…...