Supply Chain Security

Firefox's Master Key Was Sitting on GitHub

The signature that proves a Firefox update is real got exposed — and there's no way to know who saw it

Software Updates

Your AI Code Reviewer Just Approved Malware It Never Saw

A hidden comment in a pull request is all it takes to hijack the AI gatekeeper your team trusts to ship safe code

Zero Trust

The 3-Minute Security Audit Every Developer Should Run Before AI Touches Their Code

Symlink attacks, hallucinated packages, and prompt injection are turning your AI pair programmer into an attacker's easiest way in

NHI

Nobody Is Talking About AI Agent Skills Yet. They Will Be

Malicious code is now delivered as helpful app features — and 26,000 AI agents just installed one.

third-party integrations

The Agency Protecting America's Infrastructure Just Leaked the Keys to It on GitHub

CISA left live AWS GovCloud credentials in a public repo named "Private." It sat there for six months. Nobody inside the agency noticed.

Credential Security

Your AI Coding Assistant Just Cloned Your Entire Repository. You Told It To.

Convention files, prompt injection, and why the line between productivity tool and data pipeline just disappeared

Zero Trust

The Apps on Your Phone Are Installing Themselves Now. They're Also Stealing From Each Other

A self-spreading worm just ran through the tools developers use to build every app you touch. Here's what that means for you — and what to do about it.

AppSec