The Next Web

North Korea-linked npm packages impersonate Rollup polyfill tools to steal developer secrets

Malicious npm packages mimicking Rollup polyfill tooling steal browser data, crypto wallets, and AI tool credentials in a Lazarus-linked campaign.
eWeek

Clean GitHub Repo Attack Exposes AI Coding Agent Risk

Mozilla 0DIN’s Claude Code demo shows how clean GitHub repos can expose AI coding agents to prompt injection, reverse shells, ...

SimpleHelp Flaw Exploited to Deploy Malware Targeting Windows, macOS, and Linux

A SimpleHelp authentication flaw is being exploited to deploy Djinn Stealer, a cross-platform malware targeting cloud, ...
latesthackingnews.com

Programming Languages for Cyber Security: What the Tools Actually Use

Security tooling is not written in a single language. Python powers most automation. C sits at the exploit layer. PowerShell ...
ZDNet

Chainguard's new Athena coalition uses AI to fix open-source flaws - before attackers exploit them

Chainguard will use AI to protect open-source code. Athena pools open-source users, developers, and maintainers. Others are also using AI to secure open-source code. As Chainguard puts it, "The gap ...
IGN

Bank Balances Rolled Back for Forza Horizon 6 Players Who Used Exploit to Amass a Billion Credits

In response to an arcane but incredibly lucrative exploit discovered by Forza Horizon 6 players, Playground Games has confirmed that those who used the method to accumulate massive amounts of credits ...
Ars Technica

For the 2nd time in weeks, Microsoft packages laced with credential stealer

Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened them in AI ...
eturbonews

Criminal Tourism: How Organized Crime Networks Exploit Global Travel for Profit

As global travel becomes easier, organized crime networks are increasingly exploiting tourism, visa programs, and open-border systems to commit theft, fraud, burglary, and other crimes across multiple ...
Ars Technica

Millions of AI agents imperiled by critical vulnerability in open source package

Millions of AI agents and tools around the world have been imperiled by a critical vulnerability that can allow hackers to breach the servers running them and make off with sensitive data and ...
TechCrunch

Hackers have compromised dozens of popular open source packages in an ongoing supply-chain attack

In an ongoing cyberattack, hackers have compromised several popular open source projects that software developers all over the world rely on. On Tuesday, cybersecurity firms StepSecurity and SafeDep ...
Forbes

Microsoft Confirms Active 0-Day Exploit—Check Emergency Mitigation

This voice experience is generated by AI. Learn more. This voice experience is generated by AI. Learn more. Microsoft confirms Exchange zero-day, CISA warns it's under active exploitation. Updated May ...
The Next Web

Google found the first AI-generated zero-day exploit. It stopped the attack before it started.

Google identified the first zero-day exploit it believes was developed with AI and thwarted a planned mass exploitation event. The GTIG report documents state-sponsored actors from China, North Korea, ...