The campaign spans npm, Packagist, Go, and Chrome, using obfuscated JavaScript loaders and VS Code tasks to deliver malware.

The DuneSlide vulnerabilities enable zero-click prompt injection attacks that escape Cursor's sandbox and execute arbitrary code on the underlying operating system.

Sysdig says JADEPUFFER used CVE-2025-3248 in Langflow to automate intrusion, credential theft, encryption, and data wipe.

CISA warns that attackers are exploiting Microsoft SharePoint vulnerability CVE-2026-45659, a high-severity remote code ...

AI Impact tracks Wall Street’s AI oversight, DXC’s agent build, AI shopping checkout and India’s place in the AI trade.

Cisco SD-WAN zero-day CVE-2026-20245 was exploited months before disclosure: Mandiant reveals how a malicious CSV file ...

(NEXSTAR) – GLP-1 drugs, which have grown incredibly popular in recent years for their ability to help people lose substantial weight, are now friendlier to needle-phobes. The class of medications, ...

A flaw in Anthropic’s Claude Code GitHub Action let attackers bypass permission checks via a fake bot account and use prompt injection to steal OIDC tokens, gaining write access to any vulnerable ...

The controversy over vibe coding reached a new high this week after a developer added hidden instructions to his open source Java testing app to sabotage projects performed by AI coding agents. The ...

What just happened? Popular disk imaging software Daemon Tools was the victim of a sophisticated supply chain attack, with threat actors distributing trojanized Windows installers through the ...

A monthly overview of things you need to know as an architect or aspiring architect. Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with ...

A security researcher, working with colleagues at Johns Hopkins University, opened a GitHub pull request, typed a malicious instruction into the PR title, and watched Anthropic’s Claude Code Security ...