description Deep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploiting the gap between public and private ...

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: r/opensource bans AI ...

October brought a heavy run of cybersecurity disclosures involving cryptocurrency exchanges, web servers, AI tools, software ...

Volunteer-led PHP, which powers most websites, is increasingly under threat from cyberattacks using AI capabilities.

Attackers are penetrating the entire chain of trust, and Vitalik's d/acc also seeks to steer the trajectory of technological acceleration back toward defense.

Hackers are using Coruna and DarkSword exploit chains across a large web network to compromise vulnerable iPhones without ...

The Coruna iOS exploit kit now ships with a DarkSword iOS 18 chain on 608 domains. zLabs breaks down its delivery, native ...

A significant security vulnerability has been identified in Google's Brotli decoder, impacting various software platforms ...

Microsoft, Node.js, and Python package maintainers have patched Node2Shell (CVE-2026-111497), a critical Brotli decoder flaw.

Blocking install scripts closes one route for malicious npm packages. The malicious indexed-btree package shows why ...

Compare five SCA tools for detecting malicious open-source packages, from behavioral analysis and install-time blocking to ...

In my previous article, I organized what to do by role regarding the critical #vulnerability in #PHP. Actually, on that same ...