Nx Console Supply Chain Attack: What Developers Must Do Now
Nx Console v18.95.0 shipped a credential stealer that hit 6,000 developers and 3,800 GitHub repos. Rotate credentials now — here is the checklist.
@supabase/server: Auth That Runs Before Your Code Does
Supabase's new @supabase/server SDK handles JWT validation, RLS-scoped clients, and auth boilerplate before your Edge ...
OpenAI Secure MCP Tunnel: Private MCP Servers, No Firewall Changes
OpenAI shipped Secure MCP Tunnel on May 27, 2026. Connect private MCP servers to ChatGPT, ...
GlassWorm Botnet Taken Down: Audit Your Developer Environment Now
CrowdStrike and Google took down the GlassWorm botnet on May 26. Your machine may still ...
Kyverno 1.18: SSRF Patches, CEL Push, ClusterPolicy Out
Kyverno 1.18 patches two SSRF CVEs, adds CEL gzip library, and advances the ClusterPolicy deprecation. ...
npm Staged Publishing: The 2FA Gate the TanStack Attack Made Necessary
npm 11.15.0 ships staged publishing with a mandatory 2FA approval gate — the defense designed to break the exact attack chain that compromised ...
TrapDoor: The Supply Chain Attack That Hijacks Your AI
TrapDoor planted 34 malicious packages across npm, PyPI, and Crates.io — then used zero-width Unicode ...
GitHub Bans Researcher Over Windows Zero-Days and Unpaid Bug Bounty
GitHub banned security researcher Nightmare-Eclipse after they released 6 unpatched Windows zero-days. Three are actively ...
Project Lightwell: IBM and Red Hat Bet $5B on Open Source Security
IBM and Red Hat launched Project Lightwell today — a $5B initiative using AI and ...
Claude Code Security Plugin: Catch Bugs Before Production
Anthropic's free security-guidance plugin for Claude Code catches vulnerabilities in real time across three layers. ...