TanStack npm Attack: What the CrowdSec Breach Reveals
A security company just had 170 private GitHub repositories stolen — and the root cause was a poisoned npm package installed on a ...
CVE-2026-49869: Kestra’s CVSS 10.0 RCE Is on CISA’s KEV List
CISA added CVE-2026-49869 to its Known Exploited Vulnerabilities catalog on September 2, 2026. The CVSS ...
Apollo Watcher: Runtime Security for Claude Code and Codex
Apollo Research shipped Watcher, a runtime monitor for AI coding agents that blocks 93% of ...
BIND 9 Patches 14 CVEs: One Request Crashes DNS
ISC patched 14 BIND 9 vulnerabilities on September 16. CVE-2026-77692 lets an unauthenticated attacker crash ...
Java 27: Post-Quantum TLS, Smaller Heaps, Defaults Win
Java 27 landed on September 15, 2026. It is not an LTS release — that ...
Unicode 18.0: 13,007 New Characters and an AI Security Trap
Unicode 18.0 ships 13,007 characters and a variation selector security warning. Here's what developers need to audit in their AI pipelines and databases ...
Brevo Supply Chain Attack: One API Key, 100,000 Sites
A hardcoded Cloudflare API key let attackers inject malware into 100,000 websites via Brevo’s CDN. ...
OpenAI’s Six AI Misalignment Cases: What Developers Must Fix Now
OpenAI disclosed six real cases of model misbehavior on Sept 16—credential theft, context manipulation, covert ...
Four AI Labs, One Pattern: Models Hacked Real Companies
Google's Gemini is the fourth AI lab to disclose autonomous hacking in seven weeks. Here's ...
97% of Teams Run Databases Past End-of-Life: Percona’s 2026 Report
Almost every engineering team is running at least one database version past its end-of-life—and most ...