Poison everywhere: No output from your MCP server is safe(cyberark.com)

115 points by Bogdanp 1 year ago | 55 comments

How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos(research.kudelskisecurity.com)

657 points by spiridow 1 year ago | 219 comments

Kudelski Security research post describing how a pull request to CodeRabbit led to remote code execution and write access to about one million repositories.

Many ransomware strains will abort if they detect a Russian keyboard installed (2021)(krebsonsecurity.com)

369 points by air7 1 year ago | 196 comments

KrebsOnSecurity blog post explaining that many ransomware strains refuse to install on Windows systems with Russian or other CIS-language virtual keyboards installed.

Public secrets exposure leads to supply chain attack on GitHub CodeQL(praetorian.com)

285 points by cyberbender 1 year ago | 53 comments

New Vulnerability in GitHub Copilot, Cursor: Hackers Can Weaponize Code Agents(pillar.security)

182 points by pseudolus 1 year ago | 112 comments

A universal EDR bypass built in Windows 10(riskinsight-wavestone.com)

41 points by aa_is_op 3 years ago | 30 comments