TanStack npm Attack: The Worm That Forged SLSA Provenance
The Mini Shai-Hulud worm hit 42 TanStack npm packages in a six-minute window and produced the first npm packages with forged valid SLSA ...
Python 3.14 t-Strings: Safer Templating Over f-Strings
Python 3.14 t-strings return a Template object instead of a string, letting you build injection-safe ...
Claude Compliance API: 28 Security Integrations and the Gap You Must Know
Anthropic's Claude Compliance API now connects to 28 enterprise security platforms including Cloudflare, CrowdStrike, Datadog, ...
npm Typosquatting: 14 Packages Steal Your AWS and CI/CD Secrets
14 malicious npm packages impersonating OpenSearch and ElasticSearch stole AWS credentials, Vault tokens, and CI/CD ...
Docker Model Runner CVE-2026-5843: Two Flaws That Let a Bad Model Own Your Mac
Two high-severity CVEs in Docker Model Runner let any container execute code on your macOS ...
Rust 1.96.0: Copyable Ranges, assert_matches, and Two Cargo CVEs
Rust 1.96.0 ships copyable range types (RFC 3550), stabilizes assert_matches!, improves Cargo for private registries, and patches two security CVEs.
Nx Console Supply Chain Attack: What Developers Must Do Now
Nx Console v18.95.0 shipped a credential stealer that hit 6,000 developers and 3,800 GitHub repos. ...
@supabase/server: Auth That Runs Before Your Code Does
Supabase's new @supabase/server SDK handles JWT validation, RLS-scoped clients, and auth boilerplate before your Edge ...
OpenAI Secure MCP Tunnel: Private MCP Servers, No Firewall Changes
OpenAI shipped Secure MCP Tunnel on May 27, 2026. Connect private MCP servers to ChatGPT, ...
GlassWorm Botnet Taken Down: Audit Your Developer Environment Now
CrowdStrike and Google took down the GlassWorm botnet on May 26. Your machine may still ...