Coverage tagged "GitHub".
Posted by Tomasz Kaye on Oct 23 Follow-up: the fix for this issue has been merged upstream. PR #124699, "Fix heap overflow with invalid string length in binary resources", merged to master on…
Posted by Tomasz Kaye on Oct 23 Follow-up: the fix for this issue has been merged upstream. PR #124697, "Fix out-of-bounds write when loading corrupt HDR images", merged to master on 2026-10-20…
Attack overview Technical details Mitigation and protection guidance Indicators of compromise References Learn More On October 21, 2026, a compromised LiteLLM 1.107.0 release was published to the…
This release adds multiple new modules, and 6 of those modules point at a single target: Langflow, the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680)…
Key Points Aokigahara, a newly observed infostealer, has been spotted in the wild. An earlier version may have been known as Kamidere or Stygian. The malware includes traditional data theft…
Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker.
A critical Signal flaw could keep calls active after hang-up, exposing microphone or camera. Update to a fixed version immediately. A critical vulnerability, tracked as CVE-2026-113380 (CVSS score…
Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI…
For ten days, auditors appointed by the Korea Internet & Security Agency (KISA) sat together with us and worked through 80 controls. That is what it took for a company headquartered in the United…
Anthropic has updated Claude Security with ongoing code scanning and automatic fix tracking to help security teams monitor vulnerabilities as software changes. The service scans codebases for…
LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a…
A new LiteLLM supply chain attack has turned version 1.107.0, an official release of the popular open-source LLM gateway, into a credential stealer. On October 21, 2026, attackers used stolen…
arXiv:2610.28810v1 Announce Type: new Abstract: The widespread adoption of generative artificial intelligence in recent years has brought a parallel rise in prompt injection and jailbreak attacks. By…
arXiv:2610.29987v1 Announce Type: new Abstract: Facial recognition has become central to modern authentication systems, security frameworks, and personalized services. However, its widespread…
A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users.
OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread information-stealing malware…
arXiv:2610.27044v1 Announce Type: new Abstract: Anonymous peer review protects reviewers from retaliation, yet reviewer anonymity may also be weakened by artifacts released through the review process…
arXiv:2610.27244v1 Announce Type: new Abstract: Agent systems are shifting from task-scoped tool-use agents to persistent, personalized assistants such as OpenClaw. These claw-style agents maintain…
The JFrog Security Research team identified malicious code in `litellm` 1.107.0, a widely used Python interface and proxy for large language model providers. The payload wheels are a functional copy…
eMudhra Intermediate CA Compromise This is very, very bad news: The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla…
