Stories tagged “Supply Chain Security.”
12 stories
AI coding tools can introduce open-source packages at a pace security teams were never built to handle, leading to remediation debt and security work accumulating faster than teams can close it.
Vulnerability in Chinese-made routers from Zbtlink detected with backdoors that can be remotely accessed without authentication.
Dependabot now waits at least three days after a release is published before opening a pull request to prevent supply chain attacks. This cooldown configuration option in the dependabot.yml still controls the behavior, though, so you can choose a different cooldown parame…
North Korean threat actors have been observed using steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges.
A new webinar reveals how the Approval Gap forms in AI-era ad tech, where a single approved marketing tag can load fourth-party code, granting full access to customer data and checkout pages. The webinar provides a blueprint for closing this gap before an auditor, regulat…
Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request. This cooldown is now the default and requires no configuration.
A new remote access trojan (RAT) called MODBEACON has been discovered, attributed to the China-linked cybercrime group Silver Fox. The malware uses gRPC streaming for encrypted command-and-control (C2) traffic and has been found to be used in a campaign targeting technolo…
Datadog Security Labs has warned of several overlapping campaigns that are systematically enumerating corporate GitHub organizations, repositories, and user accounts through the GitHub API. The campaigns employ a mix of automated scanner tools, over 50 dormant accounts, a…
A high-severity flaw in Amazon Q Developer allowed malicious repositories to run commands and steal cloud credentials. The issue is patched in Language Servers for AWS 1.65.0.
Cordyceps CI/CD flaws expose 300+ GitHub repositories to supply-chain attacks. The issue allows attackers to hijack workflows and compromise open-source supply chains.
A security firm created a fake AI agent skill that passed security scans and reportedly reached 26,000 agents. The skill was designed to collect user email addresses and demonstrated vulnerabilities in skill-scanning tools.
Malicious plugins on the JetBrains Marketplace have been stealing AI API keys, while Chrome extensions have been capturing AI chatbot conversations.