UPDATED
IT Pro ·
European Union (EU) concept image showing flag on a digitized background with ripples flowing out from 12 stars.
BleepingComputer · · Critical severity
A security researcher has released exploit code for a Visual Studio Code (VS Code) zero-day vulnerability that allows attackers to steal GitHub authentication tokens by tricking users into clicking a link.
The Register ·
Developers seem to hate Microsoft’s new usage-based billing policy for GitHub Copilot as they report burning through a month's worth of credits in hours. “This is a staggering shift from a 'predictable subscription' to a 'stressful...
Ars Technica ·
In April, GitHub announced that it was moving subscribers from request-based billing to a usage-based model for its AI-powered Copilot service. As that new pricing model goes into effect today, many GitHub Copilot users are reporting...
CIO.com ·
Microsoft (MS) has released two new tools as open source that support the application of safety verification from the early stages of AI agent development. The tools, named ‘Rampart’ and ‘Clarity’, were released last week as part of...
Hackaday ·
There are many ways you can implement an Intel i386 CPU on an FPGA, with the use of original microcode probably being one of the most interesting approaches. This is what [nand2mario]’s z386 project does, with a recent blog post...
CIO.com ·
Google has introduced Agent Executor , an open source runtime aimed at helping enterprises run AI agents more reliably at scale, as attention shifts from building agent prototypes to managing the operational challenges of putting them...
TechRadar · · Medium severity
A pink triangle with a red exclamation mark inside on a blue digital landscape
SecurityWeek · · Critical severity
Fake automated commits injected GitHub Actions workflows containing payloads to steal credentials, CI secrets, keys, and tokens. The post Over 5,500 GitHub Repositories Infected in ‘Megalodon’ Supply Chain Attack appeared first on...
Help Net Security · · Medium severity
Source-guided vulnerability research increasingly leans on coding harnesses such as Claude Code, Codex, and Cursor to drive agent-based reviews of application code. A new MIT-licensed project from the Dutch security firm Hadrian, called...
UpGuard Blog ·
Uncover how indirect prompt injection and tool poisoning allow attackers to exfiltrate private data via AI agents—all without stealing a single credential.
Help Net Security · · Medium severity
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: TeamPCP breached GitHub’s internal codebase via poisoned VS Code extension Following TeamPCP’s claim that they’ve breached GitHub’s own...
Daniel Miessler ·
Not sure why I haven't thought more about this, but it seems like the US now has a massive economic vulnerability from cheap, high-quality, open source AI combined with cheap inference (See Cerberus, et al). Here's the scenario: US labs...
The Hacker News · · Critical severity
A new "coordinated" supply chain attack campaign has impacted eight packages on Packagist including malicious code designed to run a Linux binary retrieved from a GitHub Releases URL. "Although the affected packages were all Composer...
9to5Mac ·
Apple today published new corecrypto source code on GitHub, alongside a detailed technical post explaining the intricate work behind its post-quantum cryptography efforts across iPhone, Mac, and more.
The Register · · Medium severity
A malware-spreading scumbag swimming through GitHub pushed malicious commits to more than 5,500 repositories on Monday as part of an automated campaign called Megalodon. Similar to the earlier TeamPCP attacks that poisoned about 3,800...
TechSpot · · Medium severity
GitHub has said it found about 3,800 internal repositories accessed in the breach and stressed that these contained its own code rather than customer projects. The attackers, a group calling itself TeamPCP, claim the number is closer to...
BetaKit ·
Canadian AI firm Cohere has unveiled a new AI model that’s available to developers to use or modify as needed, for free. The news: On Wednesday, the enterprise-focused AI startup released its latest large language model: Command A+. The...
Hackaday · · Medium severity
Google’s Project Zero demonstrates a new zero-click exploit for the Pixel 10 phones, showing a full escalation from remote to kernel without user interaction. During the investigation Project Zero found unprotected memory access from...
HackRead · · Critical severity
SafeDep uncovered the Megalodon attack targeting 5,561 GitHub repositories with malicious CI workflows and cloud credential theft.
SiliconANGLE ·
Open-source AI is changing software development, empowering both developers and citizen builders alike in a domain once reserved for professional engineers. But the influx of agents now spreading across every industry is arriving fast...
The Hacker News ·
Cybersecurity researchers have disclosed details of a new automated campaign called Megalodon that has pushed 5,718 malicious commits to 5,561 GitHub repositories within a six-hour window. "Using throwaway accounts and forged author...
Ars Technica · · Critical severity
A so-called software supply chain attack , in which hackers corrupt a legitimate piece of software to hide their own malicious code, was once a relatively rare event but one that haunted the cybersecurity world with its insidious threat...
Help Net Security ·
Microsoft has open-sourced two tools aimed at bringing security discipline to AI agent development: Clarity, a structured design review tool, and RAMPART, a continuous testing framework. The release comes from Microsoft’s AI Red Team,...
The Verge · · Critical severity
When Microsoft announced it was acquiring GitHub in a $7.5 billion deal in 2018, developers were nervous . Some were concerned about Microsoft controlling GitHub, and others were taking a wait-and-see approach. Nearly eight years later,...
Infosecurity Magazine · · Medium severity
A threat actor compromised an Nx developer and posed as a legitimate maintainer to publish a malicious extension on Visual Studio Marketplace
TechRadar · · Medium severity
Help Net Security · · High severity
GitHub CISO Alexis Wales has named the malicious VS Code extension behind the breach they suffered at the hands of the threat group TeamPCP: Nx Console, a popular developer tool with 2.2 million installs. A malicious version of the...
CSO Online Security ·
Microsoft has open-sourced two new tools aimed at bringing AI safety checks much earlier into the agent development lifecycle. The tools, called Rampart and Clarity, were announced this week as part of Microsoft’s broader push to...
IT Pro ·
signage during the Singapore FinTech Festival in Singapore, on Thursday, Nov.
Wired · · Critical severity
GitHub is just the latest victim of TeamPCP, a gang that has carried out a spree of software supply chain attacks that has impacted hundreds of organizations.
BleepingComputer · · Medium severity
GitHub says the hackers who breached 3,800 internal repositories gained access via a malicious version of the Nx Console VS Code extension, compromised in last week's TanStack npm supply-chain attack.
The Hacker News · · Medium severity
GitHub on Wednesday officially confirmed that the breach of its internal repositories was the result of a compromise of an employee device involving a poisoned version of the Nx Console Microsoft Visual Studio Code (VS Code) extension....
SiliconANGLE · · Medium severity
has confirmed that hackers exfiltrated roughly 3,800 of its internal code repositories after one of its employees installed a poisoned Visual Studio Code extension, the Microsoft Corp.-owned developer platform disclosed late Tuesday....
Slashdot · · Medium severity
Longtime Slashdot reader Himmy32 writes: GitHub has announced on X that their internal repositories have been breached through a compromised VS Code Extension on an employee's workstation. Bleeping Computer reported that the attack is...
TechRepublic ·
CISA is investigating after a contractor’s public GitHub repository exposed AWS GovCloud credentials, internal files, and passwords. The post CISA Contractor Exposed Sensitive Credentials in Public GitHub Repository appeared first on...
VentureBeat · · Medium severity
GitHub confirmed on May 20 that a poisoned VS Code extension installed on an employee’s device gave attackers access to roughly 3,800 internal repositories at the Microsoft-owned code storage and authorship platform. The threat group...
The Hacker News ·
Microsoft has unveiled two new open-source tools called RAMPART and Clarity to assist developers in better testing the security of artificial intelligence (AI) agents. RAMPART, short for Risk Assessment and Measurement Platform for...
CSO Online Security · · Medium severity
Microsoft’s GitHub has suffered what appears to be its biggest ever security breach after confirming that attackers exfiltrated code from around 3,800 of the company’s internal repositories. News of the incident first emerged on May 19,...
TNW · · Medium severity
It is an unsettling irony when the world’s largest code-hosting platform becomes the victim of its own ecosystem. GitHub confirmed on Tuesday that a threat actor exfiltrated approximately 3,800 internal repositories after compromising...
Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.
Join Updated free