Business teams are vibe coding prototypes faster than anyone in security can count them, and those prototypes are at their ...

We're a long way from Kali Linux here, Toto. Grayware - software that behaves like malware without being technically malicious - is now blocked by default across Chainguard’s stack. There's a lot to ...

Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - ...

Chainguard Libraries now includes CVE remediation for JavaScript and Go; customers also receive protections from frontier ...

A weakness in npm's trust model could let attackers publish updates to legitimate packages by claiming abandoned GitHub ...

AI is evolving at a rapid pace, and the uptake of Generative AI (GenAI) is revolutionising the way humans interact and ...

P7 DarkSword adds on-device keychain and crypto wallet data theft to the iOS exploit kit, alongside two-way C2 communication.

BLAKE3 beats SHA3-256 by up to 12x on throughput benchmarks, but SHA-3 keeps its FIPS 202 edge. Full specs, pricing, and ...

Security researchers have detailed MALFEX, an npm supply-chain campaign that uses eight malicious packages to deliver remote ...

The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and ...

Your vulnerability scanner is sorting by the wrong signal. How to use CVSS, EPSS, and local context to prioritize remediation ...

AI agents are rapidly converting publicly available vulnerability clues into working exploits, rendering traditional security disclosure embargoes ineffective. Open source projects must now adopt ...