Cursor flaw lets extensions steal API keys and session tokens without user interaction, according to researchers at LayerX ...

Be honest with me. How many of your passwords are still some version of your pet’s name followed by a number? Studies have shown that roughly 80% of data breaches involve weak or reused passwords.

A malicious version of the PyTorch Lightning package published on the Python Package Index (PyPI) delivers a ...

A new report from ReversingLabs identified a new tactic by North Korean hackers: feeding malicious code to the AI systems ...

Malicious Lightning 2.6.2/2.6.3 released April 30 enable credential theft via hidden payload, leading to PyPI quarantine and ...

A threat group planted a malicious npm package in a crypto trading project through an AI-generated commit by Anthropic's ...

A single line of Python code was all it took. Developers who ran import lightning after installing versions 2.6.2 or 2.6.3 of ...

GitHub facades and Ethereum smart contracts power a March 2026 admin-targeted campaign, enabling resilient C2 rotation and ...

A malicious npm dependency slipped into an AI-assisted crypto trading project has exposed how automated coding tools can be manipulated into importing software that steals credentials, wallet data and ...

A hardcoded API key embedded in ClickUp’s public website exposed 959 corporate and government email addresses and more than 3 ...