In this issue: Code shipping velocity in the AI era moving the bottleneck not removing it, a quick breakdown of eBPF vs. API-based runtime telemetry, and three high-signal security reads.

A malicious commit disguised as SDK telemetry briefly compromised @injectivelabs/sdk-ts, exfiltrating wallet mnemonics and private keys.

Learn more about the Shai-Hulud 2.0 npm worm.

Analysis of a threat actor campaign targeting Windows users with Vidar infostealer malware via malicious npm packages

Analysis of a threat actor campaign targeting Solidity developers via three malicious VS Code extensions

A step-by-step walkthrough of how I leveraged AI to analyze, understand, and exploit the Erlang SSH pre-authentication vulnerability (CVE-2025-32433) without any existing public proof of concept. Lear...

Every minute, GitHub blocks several secrets with push protection—but secret leaks still remain one of the most common causes of security incidents. Learn how GitHub is making it easier to protect your...

Phrack staff website.

Learn how the Next.js middleware authorization bypass vulnerability works, and how to detect and remediate it.

Learn how the Kubernetes Ingress NGINX Controller vulnerabilities work, how to detect and remediate them.

YouTube video by AWS Events

Release of Supply-Chain Firewall, an open source tool for preventing the installation of malicious PyPI and npm packages

US officials urge citizens to use encrypted messaging and calls wherever they can—here’s what you need to know.

Find out whether you’re underestimating Cross-Origin Resource Sharing (CORS) vulnerabilities in our latest research.

Microsoft’s Digital Crimes Unit (DCU) has seized 256 fraudulent websites linked to ‘MRxC0DER’, who sold phishing kits under the brand names ‘ONNX’ and ‘Caffeine’. This takedown disrupts a significant ...

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages - GitHub - DataDog/guarddog: :snake: GuardDog is a CLI tool to Identify malicious PyPI and npm packages