GitHub Copilot CLI downloads and executes malware(promptarmor.com)

43 points by sarelta 8 months ago | 12 comments

Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop(errno.fr)

306 points by brohee 3 years ago | 135 comments

Linux Kernel Exploitation: Attack of the Vsock(hoefler.dev)

223 points by todsacerdoti 1 year ago | 65 comments

TPM GPIO fail: How bad OEM firmware ruins Intel TPM security(mkukri.xyz)

168 points by osks 2 years ago | 105 comments

Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised(safedep.io)

350 points by theanonymousone 5 months ago | 272 comments

SafeDep blog post analyzing a new Mini Shai-Hulud supply-chain malware campaign that compromised over 300 npm packages.

Sign in as anyone: Bypassing SAML SSO authentication with parser differentials(github.blog)

282 points by campuscodi 1 year ago | 111 comments

Malicious litellm_init.pth in litellm 1.82.8 PyPI package – credential stealer(github.com)

701 points by theanonymousone 7 months ago | 281 comments

GitHub issue in BerriAI/litellm reporting a malicious litellm_init.pth file in the 1.82.8 PyPI package that steals credentials via a supply chain compromise.

The complement of true is true, except when it's false(dryperspective.github.io)

66 points by aw1621107 22 days ago | 26 comments

Blog post examining C++ proposal P4313R1, which adds bitmask operations for enums via a C++26 annotation, and edge cases around complementing values.

Backdoor in upstream xz/liblzma leading to SSH server compromise(openwall.com)

4122 points by rkta 2 years ago | 1526 comments

Andres Freund's oss-security mailing list post disclosing a backdoor in upstream xz/liblzma tarballs 5.6.0 and 5.6.1 that compromises SSH servers.

eMudhra intermediate CA compromise(emudhra.we-have-a-problem.com)

1124 points by galadran 6 days ago | 503 comments

Disclosure page reporting that private keys of eight eMudhra intermediate CA certificates trusted by major root programs were compromised, with signed proof.

OpenCode Hacked: User credentials leaked(twitter.com)

794 points by pranshuchittora 8 days ago | 145 comments

OpenCode's post on X announcing a security breach tied to a large-scale distillation attack that affected 1.4% of OpenCode Console users.

There isn't an easy exploit for this PHP vulnerability(eliastaylor.com)

566 points by zkldi 4 days ago | 437 comments

Blog post arguing a newly disclosed PHP vulnerability is hard to exploit and that thousands of LLM-generated GitHub PoC exploits don't work against vanilla PHP.