Nx Malware, Immutable Releases, GitHub Actions Policy, PyPI Domain Protection, OPA, CodeRabbit RCE, Typosquatting GHCR, Reachability?
dependabot supports vcpkg, Python package installers: zip parser confusion attacks, DALEQ: java binary equivalence, BAXBENCH: Can LLMs Generate Correct and Secure Backends?
MCP Context Protector, Provenance Signing & Verification for Model Hubs, Cursor's Questionable Denylist, CodeQL Support for Rust, CISA SBOM Community Closes Doors
G-Suite Prompt Injections, compromised npm maintainer, crates.io announces trusted publishing, Google's OSS-Rebuild project, container isolation
What $270,000 of bug hunting open source gets you, Post-quantum cryptographic scanner pqscan, mcp-remote RCE, North Korean malicious npm packages
GitHub Immutable Releases, Deptective, Cloudflare monetizing web crawling, historic data on software supply chain attacks, Belgium is unsafe for CVD
Compromising the extension store used by Cursor & Windsurf, GitHub Advisory DB insights, leveraging GitHub Events to expose secrets, OpenSSF Japan
Google Donates A2A, GH Attestation OPA Gatekeeper Support, Malicious Transitive Dependencies, Kingfisher Secret Detection, Edara & Container Security
Docker Hub webhook security, libxml2's bug management, GerriScary's Google vulnerability, Netflix's dependency confusion, and CVE scoring
Apple Containerization, No output from your MCP server is safe, GitHub Release Assets now have digests, 16+ npm packages compromised from leaked secrets
