'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets

A PNG hiding a prompt injection could steal your repo's secrets, researchers demonstrate. The technique, dubbed 'Ghostcommit, ...

Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials

Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to ...
InfoWorld

GitHub AI agent leaks private repositories via prompt injection attack

A prompt injection attack can trick GitHub’s preview Agentic Workflows into retrieving content from private repositories and ...
techtimes

Google agents-cli: One Command Adds AI Agent Lifecycle Skills to Claude Code and Codex

The offices of Google are pictured in London on February 28, 2026. JUSTIN TALLIS/AFP via Getty Images Google released agents-cli on April 21, 2026, and it has shipped 13 updates in the 71 days since — ...

7,000 Langflow servers are under attack. LangGraph and LangChain have the same holes

Attackers are actively exploiting path traversal and SQL injection in Langflow, LangGraph, and LangChain — below where your security tools look.
The Hacker News

GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos

GitHub on Tuesday said it's investigating unauthorized access to its internal repositories after the notorious threat actor known as TeamPCP listed the platform's source code and internal ...
IEEE

DeepSecure: Hybrid Deep Learning Framework for Detecting Security Vulnerabilities in Python Code

Abstract: Learning-based software vulnerability detection has progressed rapidly; however, most empirical studies focus on C/C++ and Java and emphasize detection accuracy alone. Python, despite its ...
IEEE

Taxonomy of SQL Injection: ML Trends & Open Challenges

Abstract: SQL injections are a significant and ever-present threat to web applications and database security. During these attacks, malicious SQL statements are injected into input fields of ...