Critical Gemini Vulnerability on Chrome Browser Lets Malicious Extensions Spy on Users

A dangerous vulnerability has been discovered in the Chrome browser that reportedly affects the Gemini AI assistant feature.

Supply-chain attack using invisible code hits GitHub and other repositories

Researchers say they’ve discovered a supply-chain attack flooding repositories with malicious packages that contain invisible code, a technique that’s flummoxing traditional defenses designed to ...

New PhantomRaven NPM attack wave steals dev data via 88 packages

New attack waves from the 'PhantomRaven' supply-chain campaign are hitting the npm registry, with dozens of malicious packages that exfiltrate sensitive data from JavaScript developers.
Computer Weekly

Salesforce tracks possible ShinyHunters campaign targeting its users

Salesforce warned users of an uptick in malicious activity targeting Experience Cloud customers with misconfigured user settings via an open source tool.
InfoQ

AI-Powered Bot Compromises GitHub Actions Workflows Across Microsoft, DataDog, and CNCF Projects

AI-powered bot hackerbot-claw exploited GitHub Actions workflows across Microsoft, DataDog, and CNCF projects over 7 days using 5 attack techniques. Bot achieved RCE in 5 of 7 targets, stole GitHub ...