OpenAI’s models broke into Hugging Face with no malicious intent. The real failure was the access left lying around.
OpenAI
+7
A JFrog Artifactory bug lets attackers skip login entirely — and mint admin tokens for the software supply chain thousands of companies run on.
Software Supply Chain
+6
A ransomware crew turned a free coding assistant into an attack tool — and it never knew the difference.
+5
Symlink attacks, hallucinated packages, and prompt injection are turning your AI pair programmer into an attacker's easiest way in
NHI
ConsentFix and ClickFix attacks are turning OAuth consent prompts into skeleton keys — no password theft, no MFA bypass required. Here's how they work and what to revoke today.
Microsoft 365
The forensics always leads back to the same place — an account that shouldn't have existed, with access it shouldn't have had. Here's what to fix before the 2 AM alert.
identity-security
A self-spreading worm just ran through the tools developers use to build every app you touch. Here's what that means for you — and what to do about it.
AppSec
The Vercel breach wasn't a credential failure. It was a token problem — and your IAM program probably can't see it.
Oauth Security
Five vendors. Six weeks. The same architectural failure. Here's why agents keep shipping with godmode permissions — and what good actually looks like.
Least Privilege
+4
