grep -rl "supply-chain" ./articles
Researchers at rubyhack.ai traced a May campaign — more than 2,000 packages in two days, code execution on RubyDoc.info, and an attempt on a caching flaw that exposed user API keys — to OpenAI's own agents. OpenAI says the agents were doing benign tasks. Maintainers say nobody told them.
The 12.93 billion dollar deal for Hugging Face is confirmed in an SEC filing, not a rumour. The company that already sells the hardware models train and run on now owns the place 3 million of them are distributed from — and a hub is not storage, it is the default resolver.
The iPhone 17 is the same phone it was on 8 September and it now costs more than it did at launch. Old models get cheaper when a new generation lands, not dearer — and Apple's own storage ladder, which steepened only at the top, says exactly which component did this.
GitGuardian found a variant of the npm worm checking 469 locations across developer environments for credentials, up from 189. That number counts places it looks, not credentials it found — and what was added is the interesting part: CI/CD tooling, cloud configuration, and AI tool settings.
CVE-2026-63077 is a 9.8 unauthenticated RCE in TeamCity. CISA listed it as actively exploited on 5 August. Three days later, attackers used it against api.cadence.jetbrains.com — JetBrains' own hosted service, running JetBrains' own unpatched product — and left with a 2024 server backup, AWS IAM credentials and users' source code.
For 14 hours on 31 August, registry.coder.com served Terraform modules from servers the attacker had inserted into Coder's Cloudflare origin pool. The packages at source were never touched, which defeats every control built around checking that an artifact is what the publisher published.
Socket found Composer themes on Packagist that inject JavaScript into Vietnamese streaming sites and run a WebKit-to-kernel chain on visiting iPhones, taking keychains, SMS databases and crypto wallet seeds. The campaign targets iOS 18.4 to 18.6.x. Every vulnerability it uses has a fix.
CVE-2026-82329 lets an unauthenticated attacker forge credentials and mint administrator tokens against JFrog Artifactory, and the vulnerable state is the default one. The patch landed on 28 August; watchTowr saw exploitation from 1 September, including actors creating backdoor users.
Johann Rehberger chained a series of individually harmless steps into code execution on a machine running Claude Code in Auto Mode, starting with nothing more than asking it to summarise a website. The step that makes it work is the safety refusal. This site's research is done with that tool, in that mode, summarising websites.
Socket found 19 Chrome and Edge extensions draining wallets, harvesting hardware wallet seed phrases and stealing credentials. The operators wrote 14 of them and purchased the other five from previous owners — complete with existing users. Then they pushed an update, and Chrome installed it automatically.
A Cosmos EVM flaw let attackers underflow account balances to roughly 2^256. Cosmos Labs learned on 13 August that every chain running its software was affected, patched on the 19th without private notification, and a public pull request in a fork spelled out the exploitation path on the 20th. Six chains were drained.
Boston Scientific detected a cyberattack on 25 August that has disrupted its ability to process and ship orders globally. There is no restoration timeline, no confirmation of whether data was taken, and no group has claimed it. This is what a serious incident honestly looks like two days in.
Australian police arrested a 21-year-old and a 23-year-old over the TeamPCP supply-chain campaign, which allegedly compromised Trivy, LiteLLM, Telnyx, SAP and TanStack packages and breached the European Commission, Mistral AI, OpenAI and GitHub. The AFP puts it at half a million credentials and 300GB of data. Nothing is proven.
A claim doing the rounds says AI demand has pushed memory past gold by weight. Gold closed at $150.34 a gram; a 32GB DDR5 kit at $400 works out around $4 to $5. The claim is wrong by a factor of about thirty. What is true: DRAM is on course to rise more than 400% from early 2024, and AI will take a fifth of the world's supply.
Truffle Security spent four years pulling AWS keys out of repositories, Git history, Docker images and CI logs. Of the ones it could fully verify, 88% still authenticated this month. The median key was five years old, the oldest 17.4, and only 13.7% had ever been rotated.
Two critical bugs in TrueConf Server, patched in June, are being used by Head Mare to plant PhantomCore. Kaspersky says the attackers replaced a server file with a web shell and pushed malicious client installers. CISA added both to its exploited catalogue on 20 August with two different deadlines.
TrendAI found 14 npm packages posing as calendar utilities and carrying RedC2 4.0, a Linux implant sold on Hack Forums. There is no install hook: the payload launches when the module loads, so one transitive import runs it. The framework's Red Agent turns natural-language prompts into intrusion command sequences.
Kaspersky found previously unknown malware on Android head units running DoFun, delivered through the legitimate update mechanism of a system app over an MQTT broker. It checks in every 90 minutes, runs ad fraud, and is attributed with high confidence to the group behind the BADBOX botnet.
arrayref has over 245 million downloads. On 20 August a malicious 0.3.7 appeared on crates.io with a dependency impersonating proc-macro2, whose build script fetched a second stage over TLS with certificate validation switched off. Wiz attributes it to a North Korean actor on infrastructure overlaps with two earlier campaigns.
watchTowr reproduced CVE-2026-19478 within minutes of disclosure and then saw it used against its own honeypots. Beyond deleting repositories, it lets an attacker fabricate merge records and ban maintainers — which means the log that says a security fix was applied can itself be the lie.
Socket found 40 malicious Firefox extensions posing as OKX, Rabby Wallet and TronLink, inside a wider set of 77 sharing code and infrastructure. The clever part is not the theft — it is that many started life as harmless utilities and were repurposed later, keeping the ID, the listing and whatever trust it had accumulated.
Operation Klonen ended with four arrests in Brazil and three prosecutions in Europe over a 2023 fraud against Commerzbank. The opening was a faulty software update at a payment processor, and R$106 million in assets has been seized.
Three crises are being bundled into one story about a company cracking. The suit against OpenAI is real and names a Chief Hardware Officer. The 630GB of iPhone 18 Pro files came out of Tata Electronics. And Siri is not still broken — Apple bought a way out for about $1bn a year.
Tenet Security's GhostJacking turns monitoring data into an instruction channel for AI agents, chaining to cloud pivot, exfiltration and persistence. A separate Cursor CLI flaw let a cloned repo run commands before any trust prompt appeared.
Shai-Hulud's second wave hit somewhere between 600 and 800 packages depending on who counted. The packages were pulled within days. The credentials it published to public GitHub repos are what produced breaches months later — including Suno's.
'AI Sidebar with DeepSeek, ChatGPT, Claude and more' had 300,000 installs and a 4.6-star rating before Google removed it in January. It returned in August, clean for eleven days, then shipped a 21-line addition.
Two poisoned releases in March, published with a token stolen in the Trivy breach and kept alive by an incomplete rotation. CloudSEK's dataset of 434,000 captured files now maps possible exposure across 2,500+ organisations.
Attackers took credentials for a DigitalOcean Spaces bucket that BdThemes' promotional banner fetches JSON from. The plugin source stayed clean. Every admin page load ran the attacker's JavaScript anyway.
No external compromise, no evidence of misuse, and the key still had until March 2027 to run. Mozilla revoked it anyway — which is the right call, and a useful reference point for how a signing-key incident should read.
ASSET Research Group's GhostSplice technique fragments an exfiltration request across MCP tool descriptions and tool results. No single piece looks wrong. The agent assembles it. Several models went from 0% to 100%.
Researchers from the University of Birmingham and Fuzzware showed that a hostile SIM can drive a standardised command called RUN AT straight into the modem. Three of eighteen phones accepted it. So did six of eight Quectel modules, and an EV charger.
Sonatype tracked a campaign flooding npm with 846 packages carrying a multi-stage JavaScript loader. It fingerprints the operating system, fetches a matching payload, and on Windows patches security functions before establishing persistence through a scheduled task.
Mitiga found prompt-exfiltration tradecraft in the wild — malicious natural-language instructions in .cursorrules and CLAUDE.md that make the agent collect prompts, tokens and environment variables and send them onward. Also: 1,230+ hardcoded API keys sitting in AI instruction files.
Datadog Security Labs found that trusting a project is enough. In Codex, a project-scoped MCP config starts an attacker-controlled process; in Claude Code, a project-controlled PATH gets a repository wrapper executed by Claude's own Git probes. Neither needs a model response or an approval prompt.
Binarly found six vulnerabilities in U-Boot's FIT signature verification. Two allow code execution during verification itself. The code dates to U-Boot 2013.07, and the devices running it mostly update through vendors who may never ship a patch.
Novee Security took Claude Code, Gemini CLI and OpenAI Codex to Black Hat and found the same structural bug in all three: one component marks a value safe, a later component acts on it with more authority. Gemini CLI's carries a CVSS 4.0 of 10.0.
CVE-2026-18577 exists because the fix for CVE-2026-18556 didn't finish the job. Both are being exploited, and N-central sits at the top of MSP estates — admin on the server means Take Control access to every endpoint underneath it.
DRAM contract prices nearly doubled in a quarter as Samsung, SK Hynix and Micron moved capacity to the stacked memory that feeds AI accelerators. Device makers are responding with higher prices — and, more quietly, by holding RAM configurations still.