The Next AI Security Failure May Start With a Trusted Assistant
An AI assistant does not need to “go rogue” to create a security incident. It only needs to follow the...
software
‘Tiny11’ Gives Windows 10 Users a Risky Upgrade Path
The end of Windows 10 support is creating a hardware dilemma for older PCs. As Microsoft pushes users away from...
Gitea Vulnerability Exposes Private Container Images without Authentication
Ravie LakshmananMay 27, 2026Vulnerability / Software Security Cybersecurity researchers have disclosed a security flaw in Gitea, an open-source, self-hosted platform...
TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO
A new coordinated cross-ecosystem software supply chain attack campaign has targeted npm, PyPI, and Crates.io to distribute credential-stealing malware. The...
Microsoft Warns: Windows Zero-Day ‘YellowKey’ Can Bypass BitLocker
Microsoft has moved to contain the newly disclosed Windows zero-day vulnerability, dubbed “YellowKey,” but the company still lacks a permanent...
Microsoft Disrupts Malware-Signing Service Used by Ransomware Gangs
Microsoft says it disrupted a malware-signing service that abused Azure Artifact Signing to create fraudulent certificates used in ransomware and...
Microsoft Confirms Windows Update Bug Blocking Security Fixes
Microsoft’s latest update is failing at the one job it cannot afford to get wrong: installing. Several Windows users have...
Grafana Rejects Ransom Demand After GitHub Breach Exposes Codebase Theft
Grafana has confirmed that an unauthorized party gained access to its GitHub environment after obtaining a compromised token, allowing the...
Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials
Ravie LakshmananMay 19, 2026Software Security / Malware In yet another software supply chain attack, threat actors have compromised the popular...
Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account
Cybersecurity researchers have discovered a fresh software supply chain attack campaign that has compromised various npm packages associated with the...
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws
Ravie LakshmananMay 18, 2026Vulnerability / Software Security Ivanti, Fortinet, n8n, SAP, and VMware have released security fixes for various vulnerabilities...
Vibe Coding Cheat Sheet: Tools, Prompts, Security Tips, and More
Software development is undergoing a seismic shift as vibe coding turns plain English into functional applications in seconds. The era...
OpenAI Warns Mac Users to Update Apps After Supply-Chain Attack
OpenAI is telling Mac users to update its apps by June 12 after a developer-focused supply chain attack exposed code-signing...
Two Unpatched Windows Exploits Target BitLocker, SYSTEM Access
Microsoft’s quiet Patch Tuesday did not stay quiet for long. Soon after Microsoft released a May security update with no...
Microsoft’s Patch Tuesday Update Targets 120 Security Flaws
Microsoft’s May Patch Tuesday is a large one, even without a zero-day fire drill. The company patched 120 vulnerabilities across...
