grep -rl "open-source" ./articles
A High-severity Strong Parameters bypass in Action Pack is an incomplete fix of a 2020 advisory. That advisory corrected three iteration methods and left the fourth delegating to the raw hash.
CVE-2026-111497 is a 9.8 in the compression library inside every browser. The commit that fixes it was pushed to public master on 27 February and no release carried it for 236 days.
Trusted Publishing was the thing everyone was told to adopt because it removes long-lived tokens. It verified publishers by GitHub repository name rather than by the repository's permanent id, so a renamed or deleted repo could be taken over and used to publish to an existing package.
Socket's latest GhostAction wave commits a credential-stealing GitHub Actions workflow straight to default branches. The payload is reusable, but the attackers read each repository's existing workflows first to learn which secret names to ask for. The October variant also sweeps the full git history.
An MIT-licensed OSINT globe with 17.7k stars refuses to add person tracking and warns its own data may be wrong. A facial recognition product with the same name claims to unmask faces, detect sex changes and score attractiveness as trafficking risk, and publishes no accuracy figure at all. The name is identical. The honesty is not.
Australian police arrested a 21-year-old and a 23-year-old over the TeamPCP supply-chain campaign, which allegedly compromised Trivy, LiteLLM, Telnyx, SAP and TanStack packages and breached the European Commission, Mistral AI, OpenAI and GitHub. The AFP puts it at half a million credentials and 300GB of data. Nothing is proven.
Glassbox runs 30-plus fingerprinting techniques locally and tells you how identifiable you are. Its author measured Chrome at 99% and Tor Browser at 56%, and one work session as unique among 7.6 billion browsers. His advice is the opposite of what most privacy guides say: stop customising, and get into a large identical crowd.
Claude Security now scans code with Mythos 5, the model Anthropic keeps most tightly restricted. Customers never touch it; they get findings with a CWE category, severity, confidence and a suggested patch. Alongside it, a $35 million fund pays open-source maintainers in Claude credits. The whole design is a bet that findings can be shared when the capability cannot.
Shai-Hulud's second wave hit somewhere between 600 and 800 packages depending on who counted. The packages were pulled within days. The credentials it published to public GitHub repos are what produced breaches months later — including Suno's.
Unauthenticated SQL injection through the password-reset endpoint, every release from 1.58 onward affected, and confirmed victims already naming what was taken. It is tracked as a GitHub advisory, which means NVD-driven scanners will not see it.
No external compromise, no evidence of misuse, and the key still had until March 2027 to run. Mozilla revoked it anyway — which is the right call, and a useful reference point for how a signing-key incident should read.
Sonatype tracked a campaign flooding npm with 846 packages carrying a multi-stage JavaScript loader. It fingerprints the operating system, fetches a matching payload, and on Windows patches security functions before establishing persistence through a scheduled task.
CVE-2026-9198 gives unauthenticated remote code execution on default Langflow deployments, and it was patched in July. Telemetry recorded 650 exploitation attempts from 244 IPs before CISA added it to the KEV catalog on 5 August.