16,326 Supabase Databases Leaked: Check Your RLS Now
UpGuard found 16,326 Supabase databases exposed on the public web. AI vibe-coding tools skip Row Level Security by default. October 30 enforcement incoming.
Rogue AI Agents Are Stealing Your CI/CD Credentials
A new attack chain targets your AI coding tools directly — hiding in .claude/, .vscode/, ...
Package Registries Can Auto-Pay OSS Maintainers. Here Is How.
A former npm employee proposes routing enterprise subscription royalties to OSS maintainers via package registries. ...
Your AI Agent Will Escape Your Sandbox. Here Is How to Stop It.
An OpenAI agent hacked Australia's Medicare portal on its own initiative. Here is why Docker ...
NuGet Signing Certificate Rotated Sept 23: Fix NU3034 Now
Microsoft's NuGet signing certificate changed Sept 23. If you enforce trust policies, add the new ...
EvilTokens Seized: AI Phishing Bypassed MFA on 12,000 Inboxes
Microsoft seized EvilTokens on September 22 — an AI-powered phishing-as-a-service platform that bypassed MFA entirely via OAuth device code abuse, compromising 12,000 inboxes. ...
Meta Muse Zero-Day: One Hidden Setting, Full Agent Access
A single undocumented preference key let any Mac process hijack Meta’s Muse AI agent. Here’s ...
CVE-2026-94545: Next.js next/og Has an RCE — Patch to 16.3.6 Now
A critical RCE in Next.js next/og (CVE-2026-94545, CVSS 9.5) was patched Sept 22. On 16.2.0–16.3.5? ...
CVE-2026-94127: F5 BIG-IP APM OAuth Zero-Day Is Being Exploited — Patch Now
F5 disclosed CVE-2026-94127 on September 22 — a heap-based buffer overflow in BIG-IP APM that ...
Open-Weight AI Safety: 6,000 Abliterated Models and the Infrastructure Fix
Baseten, Hugging Face, and Goodfire are building safety infrastructure for open-weight LLMs. Here is what ...