RediShell: Critical remote code execution vulnerability in Redis(wiz.io)

111 points by mihau 1 year ago | 45 comments

SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM(aikido.dev)

317 points by birdculture 11 months ago | 98 comments

Aikido Security blog post reporting a second Shai Hulud npm supply-chain attack compromising packages from Zapier, ENS, AsyncAPI, PostHog, and Postman.

Unauthenticated remote code execution in OpenCode(cy.md)

406 points by CyberShadow 10 months ago | 135 comments

Security advisory describing an unauthenticated remote code execution vulnerability in the OpenCode AI coding assistant's local HTTP server, fixed in later versions.

Backdoor in Claude Code for VS Code extension on the Cursor Marketplace(phorion.io)

950 points by _chall 14 days ago | 542 comments

Phorion security advisory analyzing a backdoored Claude Code for VS Code extension (v2.1.313) on the Cursor Marketplace that installs a persistent reverse SSH backdoor.

Telnyx package compromised on PyPI(aikido.dev)

70 points by overflowy 7 months ago | 25 comments

OpenNMS: Visualize and monitor everything on your local and distributed networks(opennms.com)

74 points by teleforce 2 years ago | 38 comments

Your MCU likely escaped the eMudhra intermediate CA compromise(danielmangum.com)

47 points by hasheddan 23 days ago | 28 comments

Blog post explaining why microcontroller-based IoT devices are likely unaffected by the eMudhra intermediate CA private key compromise, due to minimal pinned root CA bundles.

How we hacked McKinsey's AI platform(codewall.ai)

420 points by mycroft_4221 8 months ago | 168 comments

CodeWall blog post describing how its autonomous offensive agent found vulnerabilities in McKinsey's internal AI platform Lilli.

There isn't an easy exploit for this PHP vulnerability(eliastaylor.com)

566 points by zkldi 23 days ago | 437 comments

Blog post arguing a newly disclosed PHP vulnerability is hard to exploit and that thousands of LLM-generated GitHub PoC exploits don't work against vanilla PHP.

The RCE that AMD won't fix(mrbruh.com)

343 points by MrBruh 9 months ago | 144 comments

Blog post describing a remote code execution vulnerability found by decompiling AMD's AutoUpdate software, which AMD declined to fix.

Unauthenticated remote code execution in OpenCode(cy.md)

406 points by CyberShadow 10 months ago | 135 comments

Security advisory describing an unauthenticated remote code execution vulnerability in the OpenCode AI coding assistant's local HTTP server, fixed in later versions.

What to Know About JavaScript in 2026(blog.master.dev)

17 points by eustoria 1 month ago | 2 comments

A blog post outlining what developers should know about the JavaScript language and ecosystem in 2026.