Microsoft, Node.js, and Python package maintainers have patched Node2Shell (CVE-2026-111497), a critical Brotli decoder flaw.

Blocking install scripts closes one route for malicious npm packages. The malicious indexed-btree package shows why ...

Compare five SCA tools for detecting malicious open-source packages, from behavioral analysis and install-time blocking to ...

In my previous article, I organized what to do by role regarding the critical #vulnerability in #PHP. Actually, on that same ...

Spread the love“`html If you run a website powered by PHP, you’ve probably heard the whispers, or maybe even the full-blown ...

A series of major cybersecurity incidents, from critical PHP and Node.js vulnerabilities to malware infiltrating LiteLLM, has ...

From AI-discovered PHP vulnerabilities to flaws in Node.js and popular AI tool LiteLLM, cybersecurity teams have plenty to worry about this week.

How OpenAI's AI agents escaped an eval sandbox, built a secret message board, and hacked Hugging Face, plus 8 lessons for ...

We're a long way from Kali Linux here, Toto. Grayware - software that behaves like malware without being technically malicious - is now blocked by default across Chainguard’s stack. There's a lot to ...

Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - ...

Since the end of September 2026, there has been a series of announcements regarding unauthorized access and information leaks ...

Chainguard Libraries now includes CVE remediation for JavaScript and Go; customers also receive protections from frontier ...