15 JetBrains Plugins Stole AI API Keys — 70,000 Installs
Aikido Security found 15 malicious JetBrains Marketplace plugins that silently stole OpenAI and DeepSeek API keys from 70,000 developers. Here is the full ...
LiteLLM CVE Chain: A Default User Account Becomes Full Server Access
Three vulnerabilities chain from a default LiteLLM user to full RCE. CISA confirmed active exploitation ...
GrapheneOS Ported to Android 17: What Changes Now
GrapheneOS has been ported to Android 17 with official releases coming soon. Here's what the ...
144 Mastra npm Packages Backdoored: What to Check Right Now
144 @mastra npm packages were compromised today via a hijacked contributor account and typosquatted easy-day-js ...
OpenAI Deployment Simulation: How OpenAI Predicts Model Behavior Before Release
OpenAI’s new Deployment Simulation method predicts how AI models will misbehave in production before they ...
Apple Hide My Email Moves to New Domain — What Changes for Privacy
Apple is migrating Hide My Email and Sign in with Apple to @private.icloud.com. Here's what it means for your privacy, your app, and ...
Claude Managed Agents: Self-Hosted Sandboxes and MCP Tunnels in Beta
Anthropic shipped self-hosted sandboxes (public beta) and MCP tunnels (research preview) for Claude Managed Agents ...
Fable 5 Export Ban: ‘Fix This Code’ Wasn’t a Jailbreak
Fable 5 was banned globally over a 'fix this code' prompt, not a jailbreak. 300+ ...
Amazon Linux 2 EOL June 30: Migrate Your Lambda Functions Now
Amazon Linux 2 hits end of life June 30, 2026. Six Lambda runtimes are affected. ...
ForceMemo: GlassWorm Is Now Inside Python Repos
GlassWorm's ForceMemo campaign backdoored 400+ Python repositories using stolen GitHub tokens and force-push techniques that ...