Dependency Cooldowns: Free-Rider Ethics Divide Developers
Dependency cooldowns block 80% of supply chain attacks but create ethical free-rider dynamics. Paterson proposes upload queues as superior alternative. HN divided.
OpenSSL 4.0 Encrypted Client Hello & Post-Quantum Crypto
OpenSSL 4.0.0 released today (April 14, 2026) with two critical security upgrades: Encrypted Client Hello ...
GPG Setup for Developers: Git Signing & Encryption 2026
GitHub’s green “Verified” badge on signed commits isn’t decoration. It’s cryptographic proof your code came ...
WordPress Plugin Backdoor: 30+ Plugins Supply Chain Attack
On April 7, 2026, WordPress.org permanently shut down 30+ plugins from the “Essential Plugin” author ...
Marimo RCE Exploited in 10 Hours: CVE-2026-39987
A critical remote code execution vulnerability in Marimo, a popular Python notebook tool, was exploited ...
North Korea Hijacks Axios npm: 100M Weekly Downloads Hit
On March 31, 2026, North Korean hackers spent weeks building a fake company—complete with Slack workspace, fake employee profiles, and LinkedIn posts—to trick ...
GitHub Copilot’s Trust Crisis: Ads, Data Grabs, Revolt
In March-April 2026, GitHub Copilot committed three trust violations in 30 days. On March 30, ...
Claude Code Leak: 512K Lines Exposed via npm Packaging Error
On March 31, 2026, Anthropic accidentally published 512,000 lines of Claude Code’s source code in ...
Microsoft Locked WireGuard Out of Windows Driver Signing
Microsoft locked WireGuard creator out of his developer account this week, blocking Windows driver signing. ...
CPU-Z and HWMonitor Hijacked: 6-Hour Malware Attack
CPUID confirmed CPU-Z and HWMonitor delivered credential-stealing malware for 6 hours April 9-10. Same infrastructure ...