Threat actors are exploiting CVE-2026-58138, a critical-severity remote code execution vulnerability in Orkes Conductor.

The research examines how building from source, enforcing provenance and applying layered security controls can significantly reduce exposure to open-source malware. What you'll discover Where malicio ...

The Hacker News is the top cybersecurity news platform, delivering real-time updates, threat intelligence, data breach ...

Researchers escaped OpenAI's Codex sandbox two ways, one running commands on a developer's machine from its most locked-down mode. OpenAI has patched both.

Google says attackers are using AI agents to automate more stages of cyberattacks, including scanning and credential theft.

A newly disclosed BragJack is a browser-extension attack technique that can hijack built-in AI assistants across five ...

An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by ...

Thirteen npm packages deliver WeaselBiscuit, a JavaScript stealer that harvests Chrome extension storage across Windows, macOS, and Linux.

A bug-hunting independent security research team was able to access OpenAI’s internal code system, exposing growing risks in ...

Ransomware developer sentenced to prison on Switzerland, Plugin4Shell attack targets AI coders, organizations warned of SAP flaw.

By exploiting how AI coding agents retrieve and verify plugins, researchers were able to execute malicious code even when the agent was told to use a trusted, approved version.

A malicious npm package reached over 2 million weekly downloads by hiding its payload in a routine library function rather than an install script.