6 articles tagged
On 4 August 2026 a worm published poisoned versions of keyv and cacheable carrying valid npm provenance. Rotating credentials first triggers a dead-man's switch. Nine controls for Node-heavy teams, and what npm v12 does
Turning code scanning on across a large estate is one afternoon of work and six months of alert triage. A new repository property changes the sequence, and the cost is per active committer, not per repository.
OpenAI's Codex Security CLI is Apache-2.0 open source, but it calls a gated, metered engine. How to install it, wire it into CI with exit codes and SARIF, and where it fits next to Semgrep, CodeQL and Snyk.
On July 21, 2026, Gemini 3.5 Flash Cyber found 55 unique V8 vulnerabilities to Claude Opus 4.6's 36, then shipped only to governments and trusted partners. What the gated launch signals, and what AppSec teams can use
GitHub shipped a CodeQL query on 10 July 2026 that catches prompt injection in code review: js/system-prompt-injection flags untrusted input flowing into an AI model's system prompt. Here is what it detects, how to turn
In July 2026 attackers poisoned jscrambler and AsyncAPI npm packages; the AsyncAPI payload ran at import time, past install-script defenses. How to secure your software supply chain, with a checklist and comparison
