JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.

Backstage solved the portal problem, not the platform problem. A portal organizes catalogs, documentation, and templates. A ...

How I stopped a massive WordPress spam attack with 4,700 lines of code in two days - thanks to Codex and Claude ...

SearchLeak and a three-CVE LiteLLM chain broke the same AI trust boundary in two weeks. A 5-check audit maps each gap to a ...

A vulnerability chain dubbed AutoJack in Microsoft's AutoGen Studio interface for prototyping AI agents could let attackers ...

Jellyfin has been growing in popularity for a while, as many users look for a free and open-source alternative to Plex. And with the recent Plex price hikes, the reason to switch has just gotten even ...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting Widget Factory Joomla Content Editor (JCE) to its Known Exploited ...

At least 15 malicious plugins found on the JetBrains Marketplace were designed to steal AI API keys from developers. The campaign, discovered by Aikido Security, includes plugins that act as AI coding ...

WPVibe WordPress plugin makes it easy and safe to connect virtually any AI to a WordPress site and safely edit virtually ...

Gravity SMTP WordPress vulnerability CVE-2026-4020 has drawn 17 million automated exploit attempts since May 2026, draining ...

Hackers are exploiting a vulnerability in the Gravity SMTP WordPress plugin to extract configuration data, including API keys ...