MCP Tool Poisoning: Microsoft’s .NET Fix Is Now Available
MCP tool poisoning hits production agents at 60%+ success rate. Microsoft’s new NuGet package adds three-layer governance to .NET MCP servers in one ...
Claude Security Is Now in Public Beta: What Enterprise Dev Teams Get
Anthropic opened Claude Security to all Enterprise customers. Here is what it scans, how it ...
Google CodeMender: The AI Agent That Patches Your Code Before You File a Ticket
Google's CodeMender autonomous security agent is now open to external developers. How it works, how ...
Python t-strings: What They Do That f-strings Can’t
Python 3.14 ships t-strings — a new literal that makes SQL injection structurally impossible and ...
Packagist Attack Hid Malware in package.json — 8 PHP Packages Hit
Eight Packagist PHP packages including devdojo/wave were compromised via a postinstall script hidden in package.json. ...
NVIDIA Verified Agent Skills: SkillSpector and Skill Cards (2026)
NVIDIA launched Verified Agent Skills on May 22. Here is what SkillSpector scans for, how skill cards work, and the three steps developers ...
TeamPCP Supply Chain Attack: How npm Poisoned GitHub
TeamPCP's three-stage supply chain cascade hit TanStack, Nx Console, and GitHub's 3,800 repos in 6 ...
JFrog 2026: Supply Chain Surge 451% — AI Now a Vector
JFrog’s 2026 report finds malicious npm packages up 451%, with AI agent skills and Hugging ...
vm2 Node.js Sandbox Escape: 13 Critical CVEs, Two Unpatched
vm2 — the Node.js library with 1.5 million weekly downloads used to run untrusted JavaScript ...
Exchange Zero-Day CVE-2026-42897: One Email Owns Your OWA
An attacker sends one email. The victim opens it in Outlook Web Access. No attachment, ...