Lazarus Group concealed a four-module remote access toolkit inside six fake npm Rollup polyfill packages that fired at import ...

Local AI inference at 32B-parameter quality, no cloud API required: University of Waterloo researchers released PAW on July 2 ...

JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.

CVE-2026-12957 in Amazon Q is the third MCP auto-execution vulnerability in three AI coding tools. The pattern reveals a ...

Erik Steiger discusses the operational pain of legacy PDF generation in regulated banking and manufacturing. He explains how ...

Retell AI, the fastest-growing AI voice agent platform, today announced the launch of Conductor, the first graph-native review system for production voice agents. Conductor is an AI copilot that ...

Connect all your configuration files and autogenerate code—Jsonnet is the missing piece for large code bases.

Big data management startup Komprise Inc. said today it’s introducing a major update to its platform with the launch of ...

Wordfence has blocked 17M+ exploit attempts targeting a Gravity SMTP bug that leaks API keys, OAuth tokens, and full system reports without authentication.

Any development environment that installed or imported one of the 172 compromised npm or PyPI packages published since May 11 should be treated as potentially compromised. On affected developer ...

Back in February, Valve gave Steam client beta users the option to share anonymized framerate data and hardware information with the company to “help us learn about game compatibility and improve ...

Clawdbot's MCP implementation has no mandatory authentication, allows prompt injection, and grants shell access by design. Monday's VentureBeat article documented these architectural flaws. By ...