7 min read
Incident Reports A self-replicating worm compromised 73 Microsoft GitHub repositories on June 5, 2026, via stolen contributor PAT and malicious AI coding tool configs. Contained in 105 seconds.
All Articles
6 min read
Vulnerabilities Adversa AI disclosed SymJack (symlink hijacking to plant malicious MCP servers) and TrustFall (trust dialog bypass) hitting six AI coding agents including Copilot and Cursor.
3 min read
Vulnerabilities CISA added CVE-2026-42271 to KEV after Horizon3.ai chained the LiteLLM MCP command injection flaw with a Starlette auth bypass for unauthenticated RCE. Federal deadline: June 22.
3 min read
Research depthfirst's autonomous security agent scanned FFmpeg's 1.5M lines of C code and found 21 confirmed zero-days with working PoC inputs, some dormant for over 20 years.
4 min read
Vulnerabilities A flawed permission check in Anthropic's Claude Code GitHub Action allowed attackers to use prompt injection via a crafted issue to steal CI/CD secrets. Patched in v1.0.94.