144 article(s) in our index mention this organisation.
A sophisticated supply chain attack, dubbed GhostAction, has been targeting GitHub repositories since September 2025, leveraging compromised maintainer accounts to inject a malicious workflow. Researchers advise develope…
Researchers at Lava discovered that thousands of Nvidia GPU servers were exposing DCGM Exporters to the internet, providing attackers with detailed information about GPU infrastructure and potentially disrupting AI workl…
GitHub Copilot CLI can be tricked into revealing developer secrets by presenting it with a carefully constructed webpage containing encrypted instructions and a private key. GitHub initially dismissed the issue, arguing…
A vulnerability has been identified in GitLab's AI Gateway, specifically in older versions. Users are advised to consult the GitLab security bulletin for available patches.
A critical vulnerability (CVE-2026-90970) in GitLab's AI Gateway allows a logged-in user with Duo Agent Platform access to execute arbitrary commands on self-hosted gateways. Self-managed users should immediately update…
Truffle Security discovered over 500,000 active unique credentials exposed in public GitHub repositories. The oldest credential was an AWS key committed in 2009.
A security company, Glow, discovered that AI coding agents were routinely exposing internal company images – including billing records and unreleased feature screenshots – by posting them in public GitHub repositories. T…
Multiple vulnerabilities have been discovered in GitLab, allowing an attacker to compromise data confidentiality and bypass security policies. Users are advised to apply the patches released by GitLab.
Doubts are growing over claims that an OpenAI agent hacked an Australian Medicare portal. The incident highlights a potential misconfiguration that allowed the agent to access data without requiring credentials, and sepa…
The malware, known as SectopRAT, is a .NET-based tool with remote control and data-stealing capabilities.
This week’s ‘ThreatsDay’ bulletin highlights a diverse range of emerging threats, from AI-powered attacks to sophisticated malware distribution frameworks. Key concerns include AI-poisoning of search engines to deliver p…
Russian drone attacks have caused significant internet outages in Kyiv and surrounding areas of Ukraine, impacting multiple internet providers and disrupting critical communication channels.
Multiple vulnerabilities have been discovered in GitLab, allowing for data integrity compromise, data confidentiality issues, and remote code injection (XSS). The security bulletin from GitLab provides details on how to…
GitLab's incoming email addresses, designed for creating project issues, have been found to contain highly privileged access tokens that can be publicly exposed. GitLab has since updated its UI and documentation to refle…
A leaked email address within GitLab allows anyone to push code and run CI/CD jobs as another user, including commits to protected branches like main. GitLab has acknowledged the issue and made minor documentation change…
Chinese threat actor UTA0565 has been exploiting a chain of zero-day vulnerabilities in Google Chrome and Windows to deploy CLEANGULP malware. Volexity researchers detected a coordinated effort within the Chinese CNE com…
Security researchers at Hacktron exploited two flaws in OpenAI's systems – a vulnerability in Discourse's image processing and a weakness in OpenAI's login system – to gain access to OpenAI staff accounts and a code repo…
OAuth consent abuse presents a significant security risk, allowing attackers to gain persistent access to sensitive data and systems even after a user has successfully authenticated with MFA. This isn't a problem with OA…
A vulnerability in four AI coding agents – Claude Code 2.1.179, Codex 0.146.0, and Gemini CLI – allows attackers to swap malicious plugin code into agents, even when the agent is locked to a specific version. This is ach…
A financially motivated threat actor, claiming to be a bug bounty hunter, has been linked to the development and distribution of PhantomRaven, a JavaScript information stealer, via the npm package registry. The malware u…
