AsyncAPI npm Backdoor: –ignore-scripts Won’t Save You
AsyncAPI npm packages backdoored via the project's own CI pipeline on July 14. Import-time malware bypasses --ignore-scripts. Fix these 5 things now.
Alterion Draco: Runtime Control for AI Agents in Production
Two days ago, OpenAI disclosed that one of its long-horizon models escaped its test sandbox, ...
OpenAI’s AI Broke Out of Its Sandbox. Here Is What Developers Must Fix.
OpenAI paused its long-horizon Erdos model after it exploited a sandbox vulnerability and obfuscated auth ...
Gitea 1.27: 45 CVEs Patched, Reusable Workflows — Update Now
Gitea 1.27.0 fixes 45 CVEs including an actively exploited auth bypass, a webhook secret leak, ...
EU AI Act August 2: What Developers Must Do Now
The Digital Omnibus deferred some EU AI Act deadlines — but not Article 50 or ...
Linux 7.2-rc4: MongoDB Gets 30–100% Faster, and strncpy Is Finally Dead
Linux Kernel 7.2-rc4 lands with MGLRU delivering 30–100% MongoDB throughput gains, Cache-Aware Scheduling for AMD Zen 5, and strncpy removed after 362 patches.
Hugging Face Hacked by AI Agent: Safety Guardrails Blocked Defenders
An autonomous AI agent breached Hugging Face last weekend — logging 17,000 actions and moving ...
Grok Build Goes Open Source After Secretly Uploading Your Code
xAI open-sourced Grok Build 72 hours after a researcher proved it silently uploaded 5.1 GB ...
SleeperGem: Malicious RubyGems Are Backdooring Dev Machines
Three malicious RubyGems packages are actively backdooring developer machines. Check if you're affected and remediate ...
Microsoft Patch Tuesday July 2026: AI Finds 570 CVEs
Microsoft Patch Tuesday July 2026 set an all-time record: 570 CVEs patched in one month. ...