The name on the update was real. The update wasn't. Now ask what that means for every AI tool you let into your computer.
identity-security
+6
No password. No MFA. No person. One stolen app key opened at least 162 companies’ email, and many of them may never know what was read.
Microsoft 365
+5
The signature that proves a Firefox update is real got exposed — and there's no way to know who saw it
Software Updates
A hidden comment in a pull request is all it takes to hijack the AI gatekeeper your team trusts to ship safe code
Zero Trust
Symlink attacks, hallucinated packages, and prompt injection are turning your AI pair programmer into an attacker's easiest way in
NHI
Malicious code is now delivered as helpful app features — and 26,000 AI agents just installed one.
third-party integrations
+3
CISA left live AWS GovCloud credentials in a public repo named "Private." It sat there for six months. Nobody inside the agency noticed.
Credential Security
Convention files, prompt injection, and why the line between productivity tool and data pipeline just disappeared
A self-spreading worm just ran through the tools developers use to build every app you touch. Here's what that means for you — and what to do about it.
AppSec
+7
