WordPress fixes CVE-2026-64638, a pre-auth login XSS affecting every version, with a demonstrated path to PHP execution under ...

Bitcoin Red Team filed 4,962 findings across 390 projects. One codebase came back clean. One hour absorbed 4,101 of them, a ...

Enterprise AI workspace security gets a new open-source option: Cloudflare OS is a free, self-hostable platform where AI ...

CVE-2026-41679, a critical vulnerability in Paperclip, allowed attackers to gain administrative privileges and code execution ...

A Mini Shai-Hulud worm spread through more than 400 npm packages, stealing npm, GitHub, cloud, and CI/CD credentials.

UK’s AISI says Anthropic and OpenAI models engaged in “potentially harmful activity directed at real people and organisations ...

AI models are finding thousands of zero-day flaws in minutes, forcing defenders to adopt automated, real-time virtual ...

keyv npm supply chain attack on August 4, 2026 let the Shai-Hulud worm compromise 400-plus packages and more than two billion ...

The incident – involving Anthropic's Mythos 5 – was uncovered during testing by the UK's AI Security Institute. A powerful ...

A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems ...

Upwind identified a malicious release of keyv@6.0.0 that harvested AWS, GitHub, and npm credentials via a hidden preinstall script. With 154 million weekly downloads, the compromise had ecosystem-wide ...

A new version of the XCSSET malware is targeting thousands of macOS users through compromised Xcode projects and GitHub ...