PEP 829 Makes Python Startup Safer, But Risk Remains 2026-10-15 65 Bruno Dias True MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work 2026-10-05 78 Anurag Chevendra True CVE-2026-94545 – From JSX to SVG Injection 2026-09-23 75 João Oliveira True npm ‘btree’ Malware Campaign Affects Millions of Downloads, No Need for Install Script 2026-09-17 78 Bruno Dias True React2Shell2? – CVE-2026-75604 – Next.JS Pre-Auth RCE on Windows Servers 2026-08-26 78 Dor Tumarkin True npm v12 Lifecycle Script Limits: A Real Malicious Package Risk Reduction, or Just Moving Risk Around? 2026-08-18 65 Bruno Dias True “Old Father Eternity”: Shai-Hulud Worm Strikes a 6th Time – keyv/cacheable npm Supply Chain Attack 2026-08-05 90 Bruno Dias True MCP Configuration Poisoning: Owning Your Machine With Just A Text File 2026-07-23 70 Bruno Dias True Sequel to ChainVeil npm Malware Targets Vite Ecosystem 2026-07-14 75 Pavan Gudimalla True Operation Navy Ghost: How Attackers Planted a Telegram-Powered Backdoor Across Fake pyrogram Packages on PyPI 2026-06-25 90 Pavan Gudimalla True ChainVeil: A Malicious npm Supply Chain Attack by SuccessKey 2026-06-15 88 Checkmarx Team True OverDoS: Taking Down Over 70,000 n8n Instances 2026-05-12 75 Ori Ron True Same Origin, Same Tricks: Bypassing n8n’s CSP Sandbox (CVE-2026-27578) 2026-04-06 75 Ori Ron True Rapid Exploitation and Clever Malware in the Supply Chain, Last Week In AppSec (2026-04-02) 2026-04-02 80 Darren Meyer True GlassWorm Targets Developer IDEs Again, Hiding Staged Malware Behind Runtime-Rebuilt Loaders 2026-03-23 80 Daniel Miranda True Unearned Confidence: AI Security Reviewers Don’t Really Get It 2026-03-05 30 Alon Lerner True AI fights and more attacks on dev infrastructure: Last Week in AppSec for 4. March 2026 2026-03-05 80 Darren Meyer True Last Week in AppSec for 26. February 2026 2026-02-26 75 Darren Meyer True Learning About LLM-Based Zero-Day Hunting with Claude Code’s Opus 4.6 2026-02-25 15 Ori Ron True Protecting yourself against malicious open-source packages 2026-02-19 75 Darren Meyer True Last Week in AppSec for 12. Feb 2026 2026-02-12 78 Darren Meyer True Last Week in AppSec for 12. Feb 2026 2026-02-12 78 Darren Meyer True Solidity devs targeted again: Malicious VS Code extension drops ScreenConnect-based remote access trojan (RAT) 2026-01-29 75 Daniel Miranda True Last Week in AppSec for 29. January 2026 2026-01-29 68 Darren Meyer True Last Week in AppSec for 15. January 2026 2026-01-15 68 Darren Meyer True Last Week in AppSec for 08. January 2026 2026-01-07 70 Darren Meyer True AI Model Confusion: An LLM/AI Model Supply Chain Attack 2026-01-06 75 Ori Ron True Turning AI Safeguards Into Weapons with HITL Dialog Forging 2025-12-16 55 Ori Ron True Cybersecurity AI agent is Vulnerable to Command Injection (CVE-2025-67511) 2025-12-11 90 Darren Meyer True Inside Shai-Hulud’s Maw: How The NPM Worm Exploits And Propagates 2025-12-09 90 Bruno Dias True Taking Down More Malicious VSCode Extensions in the ‘Prettier’ Campaign 2025-12-05 50 Darren Meyer True React2Shell (CVE-2025-55182) Deserialization to Remote Code Execution in React and Next.js 2025-12-04 95 Alex Shleymovich True Exploiting Markdown Injection in AI agents: Microsoft Copilot Chat and Google Gemini 2025-12-04 70 Ori Ron True Last Week in AppSec for 02. December 2025 2025-12-01 75 Darren Meyer True 11 Emerging AI Security Risks with MCP (Model Context Protocol) 2025-11-25 55 Tal Folkman True How we take down malicious Visual Studio Code extensions 2025-11-13 60 Daniel Miranda True Last Week in AppSec for 11. November 2025 2025-11-11 45 Darren Meyer True Last Week in AppSec for 04. November 2025 2025-11-04 65 Darren Meyer True Last Week in AppSec for 28. October 2025 2025-10-28 70 Darren Meyer True Last Week in AppSec for 21. October 2025 2025-10-21 60 Darren Meyer True Last Week In AppSec for 14. October 2025 2025-10-14 70 Darren Meyer True Last Week in AppSec for 07. October 2025 2025-10-07 70 Darren Meyer True NPM Malware Alert: `@lanyer640/mcp-runcommand-server` with Reverse Shell 2025-10-02 80 Darren Meyer True Last Week in AppSec for 30. September 2025 2025-09-30 65 Darren Meyer True When Vigilance Causes an Outage: The NPM Stylus Package Outage 2025-07-29 10 Rom Gotshal True Last Week in AppSec for 29. July 2025 2025-07-29 60 Darren Meyer True Last Week in AppSec for 22. July 2025 2025-07-22 78 Darren Meyer True Supply Chain Phishing Campaign Drops More Malware Into NPM: got-fetch 5.1 2025-07-21 75 Tal Folkman True Last Week in AppSec for 15. July 2025 2025-07-15 60 Darren Meyer True Last Week In AppSec for 08. July 2025 2025-07-08 55 Darren Meyer True 
