Claude Code Backdoor on Cursor Hit 5,000 Devs — Check Now
Cursor's marketplace served a trojanized Claude Code extension to ~5,000 developers for 11 hours. Here's what the malware did and how to check ...
Wasmtime Cranelift Sandbox Escape: Two CVSS 9.9 CVEs
Two Wasmtime Cranelift sandbox escape CVEs rated CVSS 9.9 let crafted WebAssembly modules escape their ...
GitHub Octoverse 2026: AI Agents Start 40% of Pull Requests
GitHub’s Octoverse 2026 report landed Tuesday with a number that rewrites the job description: AI ...
PHP2Shell: Critical PHP RCE — Patch Now
PHP2Shell (CVE-2026-109618 & CVE-2026-109619) is actively exploited unauthenticated RCE. 32M services still vulnerable. Patch steps ...
Akamai Launches Edge AI Inference and Agent Sandbox — WebAssembly Isolation for Agent Code
Akamai shipped a managed inference service and a WebAssembly-based agent sandbox in beta. Here is ...
LiteLLM Shipped Malware on October 21 — 49K Downloads Before Anyone Noticed
On October 21, 2026, someone with maintainer access to LiteLLM pushed a poisoned release — version 1.107.0 — to PyPI and Docker Hub. ...
EMBRACE: AI Coding Tools Leaking SSH Keys — Two Unpatched
Forever Security's EMBRACE research found VS Code and Codex can drain SSH keys and credentials ...
Binance Lost $5.8B to EIP-7702: What Ethereum Devs Must Do
Binance lost $5.8B on October 29 — the largest crypto hack ever. The Ethereum attack ...
CVE-2026-98432: Linux Kernel TCP Flaw — No Ubuntu Fix Yet
CVE-2026-98432 is a CVSS 9.8 use-after-free in the Linux TCP stack. Ubuntu and RHEL have ...
Anthropic’s sandbox-runtime: Sandbox AI Agents Without Containers
Anthropic open-sourced the OS-level sandbox behind Claude Code as an npm package. Here’s how to ...