Tag: software
-
Anthropic: Mythos finds more than 10,000 software flaws in first month
Early results show a tenfold jump in bug discovery at some partners, and a widening gap between finding flaws and fixing them. First seen on cyberscoop.com Jump to article: cyberscoop.com/anthropic-mythos-software-flaws-glasswing/
-
Prüfung des KI-Reifegrads in Unternehmen
Veeam Software, das Unternehmen für Data- und AI-Trust, hat die Einführung seines ‘Data and AI Trust Maturity Model” bekanntgegeben. Dabei handelt es sich um ein wissenschaftlich fundiertes und von Kunden validiertes Rahmenwerk zur Prüfung des KI-Reifegrads in Unternehmen. Es hilft Unternehmen, die Effektivität ihrer KI-Steuerung und -Operationalisierung zu bewerten, zu vergleichen und zu verbessern. Denn…
-
Anthropic: Claude Mythos identified 10,000+ software flaws
Anthropic and its Project Glasswing partners have identified more than 10,000 high- or critical-severity vulnerabilities in critical software systems, the company announced in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/26/anthropic-project-glasswing-update/
-
Software and services shift benefits Westcon-Comstor
Distributor shares full-year numbers as it continues to look for higher-value business and areas that deliver recurring revenues First seen on computerweekly.com Jump to article: www.computerweekly.com/microscope/news/366643572/Software-and-services-shift-benefits-Westcon-Comstor
-
Quasar RAT Hits Developers With Fileless Linux Attacks
Quasar Linux (QLNX) is a new, stealthy Linux Remote Access Trojan that quietly turns developer and DevOps workstations into high”‘value beachheads for software supply”‘chain attacks, using fileless execution, an eBPF rootkit, PAM backdoors, and a P2P C2 mesh to evade conventional defenses. Despite its name, it is unrelated to the Windows”‘focused QuasarRAT family. It is…
-
Iranian Hackers Deploy MiniFast and MiniJunk V2 via Phishing and SEO Poisoning
The Iranian state-sponsored threat actor known as Nimbus Manticore (aka Screening Serpens and UNC1549) has been attributed to a fresh campaign using lures impersonating organizations in the aviation and software sectors across the U.S., Europe, and the Middle East following the joint U.S.-Israeli military campaign against the country in late February 2026.The activity, besides embracing…
-
Megalodon Supply Chain Attack Hits 5,500+ GitHub Repositories in Six Hours
A large-scale software supply chain attack dubbed “Megalodon” has compromised more than 5,500 repositories on GitHub, raising fresh concerns about the growing abuse of automated development pipelines and GitHub Actions workflows. The incident, uncovered by SafeDep, involved thousands of malicious commits that injected credential-stealing payloads into repositories over a short period of time. First seen…
-
Megalodon Supply Chain Attack Hits 5,500+ GitHub Repositories in Six Hours
A large-scale software supply chain attack dubbed “Megalodon” has compromised more than 5,500 repositories on GitHub, raising fresh concerns about the growing abuse of automated development pipelines and GitHub Actions workflows. The incident, uncovered by SafeDep, involved thousands of malicious commits that injected credential-stealing payloads into repositories over a short period of time. First seen…
-
Third-Party Cyberattack Impacts Patient Information at The Oncology Institute
The Oncology Institute disclosed a data breach tied to a third-party vendor, potentially exposing patient information after a 2025 cyberattack. The Oncology Institute has confirmed that patient information was impacted in a cybersecurity incident involving a third-party software provider. The healthcare network first disclosed the security breach in November 2025 while the vendor’s investigation was…
-
The AI Era Is Creating a Bug Hunting Arms Race
As attackers ramp up their AI exploit development, the search for software vulnerabilities is changing rapidly. First seen on wired.com Jump to article: www.wired.com/story/the-ai-era-is-creating-a-bug-hunting-arms-race/
-
Hackers Exploit Shared CDNs to Evade Domain Reputation Filters
Hackers are increasingly abusing shared Content Delivery Network (CDN) infrastructure to bypass domain-reputation-based security controls using a newly identified technique called “Underminr.” Underminr is not a conventional software flaw but an inherent weakness in how modern CDNs handle multi-tenant traffic. CDN providers such as Cloudflare, Akamai, AWS CloudFront, and Fastly route traffic for millions of…
-
Hackers Hide Linux Malware in SSH-Like Package Filename
Hackers have been observed disguising a malicious Linux payload under an SSH-like filename during software installation, as part of a coordinated supply chain attack targeting developer ecosystems. The attack hinges on a hidden post-install script embedded inside package.json, rather than the expected composer.json used in PHP environments. This subtle placement allows the malicious code to evade detection during routine dependency…
-
TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO
A new coordinated cross-ecosystem software supply chain attack campaign has targeted npm, PyPI, and Crates.io to distribute credential-stealing malware.The campaign, codenamed TrapDoor, spans more than 34 malicious packages across over 384 versions. The earliest activity was recorded on May 22, 2026, at 8:20 p.m. UTC, with new packages published to the ecosystems in waves from…
-
GitHub Strengthens npm Security With Staged Publishing Protection
GitHub has introduced a major security enhancement to the npm ecosystem with the general availability of staged publishing and new install-time controls in npm CLI version 11.15.0. These updates are designed to reduce software supply chain risks, particularly those arising from compromised developer accounts, malicious package updates, and automated CI/CD workflows. GitHub Strengthens npm Security…
-
Hackers Compromise 34 npm, PyPI, and Crates Packages in Major Supply Chain Attack
Hackers have launched a large-scale software supply chain attack targeting developers across npm, PyPI, and Crates.io, compromising at least 34 open-source packages and hundreds of associated versions. Security researchers at Socket are tracking the campaign as “TrapDoor,” a crypto-focused credential stealer designed to infiltrate developer environments and exfiltrate sensitive data. Cross-Ecosystem Supply Chain Attack The…
-
Hackers Compromise 34 npm, PyPI, and Crates Packages in Major Supply Chain Attack
Hackers have launched a large-scale software supply chain attack targeting developers across npm, PyPI, and Crates.io, compromising at least 34 open-source packages and hundreds of associated versions. Security researchers at Socket are tracking the campaign as “TrapDoor,” a crypto-focused credential stealer designed to infiltrate developer environments and exfiltrate sensitive data. Cross-Ecosystem Supply Chain Attack The…
-
Top 10 Best Static Application Security Testing (SAST) Tools for Security Teams in 2026
The complexity of modern software development requires security to be deeply embedded within the engineering pipeline rather than treated as an afterthought. Whether you are managing extensive front-end codebases or back-end API integrations, catching flaws before code is compiled is crucial. This proactive approach is the essence of Static Application Security Testing (SAST). By identifying…
-
npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks
GitHub has rolled out new controls for npm to improve the security of the software supply chain, giving maintainers the ability to explicitly approve a release prior to the packages becoming publicly available for installation.Called staged publishing, the feature is now generally available on npm. It mandates that a human maintainer pass a two-factor authentication…
-
Das Ende der Cybersecurity? Was Anthropics Claude Mythos Preview für Software bedeutet
First seen on t3n.de Jump to article: t3n.de/news/cybersecurity-ki-claude-mythos-preview-1742439/
-
Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software
Anthropic on Friday disclosed that Project Glasswing has helped uncover more than 10,000 high- or critical-severity vulnerabilities across some of the most “systemically” important software across the world since the cybersecurity initiative went live last month.Project Glasswing is an effort led by the artificial intelligence (AI) company, as part of which a small set of…
-
Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer
Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive credential-stealing framework.The affected packages include – laravel-lang/lang laravel-lang/http-statuses laravel-lang/attributes laravel-lang/actions”The timing and pattern of the newly published tags First seen on thehackernews.com Jump to article: thehackernews.com/2026/05/laravel-lang-php-packages-compromised.html
-
Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer
Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive credential-stealing framework.The affected packages include – laravel-lang/lang laravel-lang/http-statuses laravel-lang/attributes laravel-lang/actions”The timing and pattern of the newly published tags First seen on thehackernews.com Jump to article: thehackernews.com/2026/05/laravel-lang-php-packages-compromised.html
-
Trend Micro warns of Apex One zero-day exploited in the wild
Japanese cybersecurity software company Trend Micro has addressed an Apex One zero-day vulnerability exploited in attacks targeting Windows systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/trend-micro-warns-of-apex-one-zero-day-exploited-in-attacks/
-
A hacker group is poisoning open source code at an unprecedented scale
GitHub is just the latest victim of TeamPCP, a gang that has carried out a spree of software supply chain attacks. First seen on arstechnica.com Jump to article: arstechnica.com/information-technology/2026/05/a-hacker-group-is-poisoning-open-source-code-at-an-unprecedented-scale/
-
Flipper Introduces Flipper One as a Modular Linux-Based Cyberdeck
Flipper Devices has officially unveiledFlipper One, a modular, Linux-based cyberdeck designed to push the boundaries of open hardware and portable network analysis platforms. Unlike the popular Flipper Zero, the new device targets high-performance networking, software-defined radio (SDR), and embedded Linux development, positioning itself as a powerful toolkit for cybersecurity professionals, researchers, and hardware developers. Flipper…
-
Mythos-Level AI Is Creating a Tech Debt Crisis
Advanced AI Models Find More Holes Than Enterprise Security Teams Can Plug. Artificial intelligence models such as Anthropic’s Mythos are rapidly exposing decades of hidden software security debt, forcing CIOs and CISOs to rethink vulnerability management, remediation capacity and the trade-offs between availability and breach prevention. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/mythos-level-ai-creating-tech-debt-crisis-a-31750
-
7 Best Attack Surface Management Software in 2026
Efficiently manage your attack surface in 2026 with industry-leading tools. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/networks/attack-surface-management-tools/
-
7 Best Attack Surface Management Software in 2026
Efficiently manage your attack surface in 2026 with industry-leading tools. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/networks/attack-surface-management-tools/
-
7 Best Attack Surface Management Software in 2026
Efficiently manage your attack surface in 2026 with industry-leading tools. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/networks/attack-surface-management-tools/