Threat actors are exploiting CVE-2026-58138, a critical-severity remote code execution vulnerability in Orkes Conductor.

Thirteen npm packages deliver WeaselBiscuit, a JavaScript stealer that harvests Chrome extension storage across Windows, macOS, and Linux.

The company has launched agent runtime security, a product designed to help engineering teams secure the AI agents they are building while giving security teams the governance and compliance evidence ...

Both Google and Uncle Sam warned that attackers have exploited a zero-day improper authorization bug in Pixel phones' ...

Malicious JavaScript campaigns on e-commerce storefronts evaded VirusTotal in 7 of 8 cases, exposing a structural gap in signature-based scanning. Cloudflare's graph neural network caught all eight ...

CrowdStrike says PhantomRaven was likely LLM-generated and spread through malicious npm packages that collect developer credentials and CI/CD secrets.

Researchers find attackers now infect widely used package at runtime, sidestepping recent lifecycle-script restrictions entirely. chaeckmarx ## A New Evasion Technique Emerges ...

Postmaster general David Steiner said, ‘I don’t get to decide what rules that are put on us that I decide to accept or not accept.’ ...

The other day, I distributed something called a daily report automation kit. That runs on something called GAS (Google Apps Script).However, even if you are told it "runs on GAS," I think you might ...

CrowdStrike links PhantomRaven malware to a bug bounty hunter, finding LLM-generated code, malicious npm packages and ...

Google says attackers are using AI agents to automate more stages of cyberattacks, including scanning and credential theft.

Adam Carmi, Applitools CTO and Co-Founder, will demo these new features and how they bridge the Probabilistic Validation Gap in agentic workflows during a live webinar on September 24, 2026. Register ...