The FBI warned that TeamPCP software supply chain attacks targeted developer tools to steal cloud credentials, SSH keys, and ...

Recently announced tie-ups between ransomware group Vect, supply-chain attack specialists TeamPCP and data-leak stalwart ...

GitHub secret scanning now extends beyond org-owned repositories: Public Monitoring scans all of GitHub.com in real time, ...

Attackers can inject indirect prompts in normal-looking repositories to trick Claude Code into spawning a reverse shell.

Zscaler found attackers using SEO poisoning and hidden prompts in malicious websites to manipulate AI agents into making cryptocurrency payments.

By registering the LongCat-2.0 repository under the open-source MIT License, Meituan positions the architecture with maximum ...

Because Krea relinquishes centralized control over the downstream deployment of its open weights, the contract legally binds ...

Eclipse Open VSX has reached 1.0.0, highlighting its role as a vendor-neutral registry for VS Code-compatible extensions.

An agentic coding tool tasked with cloning and setting up a seemingly benign GitHub repository could execute a malicious ...

Microsoft GitHub hack hit open-source AI tools, exposing developer passwords and cloud credentials. Here’s why SA tech teams should care.

Remember when writing code was free? AI is pushing software development into usage-billed proprietary platforms. But history repeats itself, and open foundations tend to win.

China now has an open-weight model that can find software vulnerabilities and create attacks for anybody to use.