Security News

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes validated and exempt from expiry after its first successful publish," the Microsoft-owned subsidiary

Related Companies

N

nokia

G

github

N

npm

Sandbox vulnerability gives rogue AI agents a path to escape and leak data, research says

The new research, published by AI security startup AIR, found that a network filtering flaw in Vercel Sandbox — a tool used to run code in isolated environments — could allow agents to exploit certificate validation processes to transmit data outside approved networks.

West African scam compounds raided, more than 100 suspected trafficking victims ‘rescued’

More than two dozen people were arrested by police in Ghana and Nigeria as part of a U.K.-hosted operation that also included tech companies.

Healthcare Sees No Relief from Cyberattacks Disrupting Patient Care

Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach

Most of the affected individuals are Meta employees in the United States and they are being offered credit monitoring services. The post Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach appeared first on SecurityWeek.

Related Companies

N

nokia

M

Meta

G

github

The CISO Journey – Part 10

Build a Team, Not a Dependency If your team cannot function without you, are you really leading the team—or have you become its biggest dependency? It is a question worth…

Ivanti warns of Connect Secure zero-day exploited in attacks

Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]

Related Companies

I

ivanti

O

openvpn

A

adobe

T

tanium

Docker Hub flaw let attackers impersonate users, tamper with images

Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal access token (PAT). [...]

Related Companies

D

docker

J

jetbrains

A

anephenix

H

hubert

North Korean hackers target Ukrainian experts for possible intelligence on Russia's war

North Korean hackers have been targeting Ukrainian experts in diplomacy, security and international policy amid Pyongyang’s growing military cooperation with Russia.

Ivanti waarschuwt voor misbruik van lek in Connect Secure vpn-servers

Ivanti waarschuwt klanten voor actief misbruik van een kwetsbaarheid in Ivanti Connect Secure vpn-servers. Via het ...

Related Companies

I

ivanti

O

openvpn

A

adobe

T

tanium