EL MOSTAFA OUCHEN·1h agoSigned, Provenanced and Malicious: Hijacked Accounts Shipped Malware in bee-js 13.3.0For about 75 minutes on 9 November, anyone who installed version 13.3.0 of the npm package @ethersphere/bee-js received malware, and Swarm…
Ivan Kharakternyk·6h agoWhen the Script on Your Site Isn’t Yours: Lessons From the Plerdy CompromiseBetween 27 August and 3 September 2026, the analytics tracker of the Ukrainian service Plerdy served visitors of thousands of websites more…
Harini Ganesan·8h agoOne Compromised Account, Hundreds of npm Packages: What the 2026 Keyv Attack Teaches UsAn npm supply-chain attack in August 2026 showed how one compromised developer account could put hundreds of packages at risk. Here’s what…
Moek Thona·1d agoThe AI Coding Agent Backdoor That Didn’t Need to Fool the AIA compromised Claude Code extension exposed a security boundary that better prompts and smarter models cannot protect.
0xK1L·4d agoThe Polymarket Script Attack: How a Hijacked Third-Party Script Drained Traders in Under an HourBlack October 2026, part 14: a tampered monitoring script loaded on Polymarket’s site used traders’ own logged-in sessions to sell…
0xK1L·4d agoA Trojanized “Claude Code” Extension in Cursor’s Marketplace: How an SSH Backdoor Shipped as an…Black October 2026, part 13: for about 11 hours, Cursor’s extension marketplace served tampered versions of the Claude Code extension that…
Dipikanta Dutta·4d agoOur risk assessments can go stale faster than our review cycles and What sould we do to solve thisI keep coming back to one question: how long should a vulnerability risk assessment remain valid?
Vassilios Karakoidas·4d agoBinance Security Incident: The keg nobody looks at twiceOn 29 October 2026, about 6.34 billion US dollars in digital assets at Binance were “impacted” (their word; 2.85 billion of it was frozen…
Gowthaman Arumugam·5d agoBefore Your Security Team Says Yes: What mcp-bastion 1.4.2 and 1.5.0 Ship for a Shadow PilotA warehouse installs a new fire alarm. Before letting it shut down the conveyor lines, the safety team runs it in test mode for two weeks…
Pooja Bolla·5d agoSoftware Supply Chain Security on Kubernetes, Part 3: Enforcing Signatures and SBOM Attestations…How I got the cluster to refuse unsigned or unscanned images with one Kyverno policy, the attacks it stopped in my lab, and the failure…
