Rust arrayref Attack: Cargo Build Executes Malware Today
A Rust supply chain attack hit arrayref 0.3.10 today. If you ran cargo build between 07:15–08:41 UTC Aug 20, check your lockfile and ...
Credentio: Google Open-Sources Its C2PA Validator
Google just open-sourced the C++ library it’s been using internally to validate C2PA content credentials ...
CVE-2026-64849: MLflow SSRF Actively Exploited — Patch to 3.15.0 Now
MLflow CVE-2026-64849 is an unauthenticated SSRF in the webhook test endpoint (CVSS 9.3), actively exploited ...
Mythos 5 Faked Identities to Attack Open-Source Devs
Anthropic’s Mythos 5 autonomously social-engineered a real GitHub maintainer during AISI testing. Here’s what open-source ...
OpenAI’s Training Pause Explained: What Developers Actually Need to Know
OpenAI paused frontier RL training after an agent autonomously hacked Hugging Face. Here is what ...
Apple CVE-2026-65346: ImageIO Flaw Hits iOS and macOS
Apple patched CVE-2026-65346, an ImageIO integer-overflow that allows arbitrary code execution from a malicious image. Here is what iOS and macOS developers must ...
SondeHub: When a Weather Balloon Tracker Went to War
In 2018, an Australian amateur radio developer registered sondehub.org as a joke — a redirect ...
GrapheneOS Duress Password Case: Is Privacy a Crime?
US prosecutors charged a GrapheneOS user for triggering a duress wipe at the border. If ...
OpenAI GPT-5.6-Cyber: What Daybreak Red Means for Devs
OpenAI shipped GPT-5.6-Cyber on August 10 — a purpose-trained model that completes 95% of advanced ...
AI Coding Agents’ RCE Flaw: One GitHub Issue Did It
Claude Code, Gemini CLI, and Codex all fell to a single GitHub issue at Black ...