» Tag
security
32 postsRust crate arrayref 0.3.10 pulls in malware via proc-macro1 dependency
crates.io package arrayref 0.3.10 pulls in malicious proc-macro1, executing remote payloads and affecting Rust GUI projects like egui and iced.
APC Framework Closes Authorization Gaps in Multi-Agent LLM Systems
A new authorization framework, APC, tracks delegated authority to block prompt-injection and unsafe action combinations in AI agents.
Operation CameraSwarm: 14,000+ Dahua Cameras Compromised
Hunt.io traced Operation CameraSwarm to an exposed dev directory, revealing three exploit paths behind 14,000+ compromised Dahua cameras.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comPython library verifies OpenAI's signed AI agent traffic (RFC 9421)
regent-httpsig is an open-source Python library that verifies and signs OpenAI-style AI agent HTTP traffic per RFC 9421 and Web Bot Auth drafts.
Spectre Flaw Leaks JWT Tokens on Cloudflare Workers via Remote Timers
A new Spectre attack bypasses Cloudflare Workers' DyPrIs defense, leaking JWT tokens via microarchitectural timers; Cloudflare responded with MPK-based isolation.
New API integer overflow turns $0.10 balance into $16.9 trillion
CVE-2026-71479 lets one request overflow New API's billing math, turning a $0.10 balance into $16.9T. CVSS 9.1, fixed in v1.0.0-rc.18.
CertiK Uncovers Five DoS Vulnerabilities in Ethereum's Besu Client
CertiK found five DoS vulnerabilities in Ethereum's Besu client, patched in v26.7.1 with advisories following two weeks later.
Malicious Rust Crate Arrayref Executes a Build-Time Payload
A compromised release of the arrayref crate runs a malicious payload at build time, raising security concerns for developers.
Wallet SDK Generates BIP39 Seeds from Math.random() — Is This Bounty-Eligible?
A security researcher questions the bounty eligibility of a wallet SDK's use of Math.random() for BIP39 seed generation.
An Open Agent Security Benchmark: Uncaught Attacks
An open benchmark featuring 497 attacks targeting modern LLM agents has been established.