Malicious PyPI packages give hackers control of Telegram bot servers

A campaign active since last November has been targeting Python developers building Telegram bots with trojanized Pyrogram ...

After the catch: What some hunters do with carcass of pythons they catch

Preserving what's left of a python after its caught and killed requires a great deal of time, skill and patience.
CSOonline

Google’s Vertex AI SDK could allow RCE through bucket squatting

Google reportedly patched a flaw in the Vertex AI SDK for Python that could allow attackers to hijack model uploads and trigger remote code execution across tenants. A design flaw in the Vertex AI ...
GitHub

srsly: Modern high-performance serialization utilities for Python

Additionally, it includes a heavily customized fork of msgpack-numpy, with corrected round-trip behaviour for np.float64 objects. This will automatically install/upgrade all dependencies. numpy and ...
Ars Technica

OpenAI is acquiring open source Python tool-maker Astral

OpenAI announced Thursday that it has entered into an agreement to acquire Astral, the company behind popular open source Python development tools such as uv, Ruff, and ty, and integrate the company ...
Microsoft

Case study: Securing AI application supply chains

The rapid adoption of AI applications, including agents, orchestrators, and autonomous workflows, represents a significant shift in how software systems are built and operated. Unlike traditional ...
The Hacker News

Critical LangChain Core Vulnerability Exposes Secrets via Serialization Injection

A critical security flaw has been disclosed in LangChain Core that could be exploited by an attacker to steal sensitive secrets and even influence large language model (LLM) responses through prompt ...
acm.org

Malicious AI Models Undermine Software Supply-Chain Security

Integrating malicious AI models 6 into software supply chains presents a significant and emerging threat to cybersecurity. The attackers aim to embed malicious AI models in software components and ...
Hosted on MSN

Meta Llama Framework Vulnerability Sparks AI Security Alert

A recently discovered vulnerability in the Meta Llama framework may lead a gateway to remote code execution attacks on AI based systems. Suggestion came in from CVE-2024-50050 saying that the security ...
GitHub

A modern, header-only C++ library for MessagePack serialization and deserialization.

msgpack23 is a lightweight library that provides a straightforward approach to serializing and deserializing C++ data structures into the MessagePack format. It is written in modern C++ (targeting ...
CSOonline

Attackers hide malicious code in Hugging Face AI model Pickle files

The popular Python Pickle serialization format, which is common for distributing AI models, offers ways for attackers to inject malicious code that will be executed on computers when loading models ...