Malicious npm packages evade install-script defenses at runtime

An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by ...
Hackread

New GhostCode Phishing Kit Hijacks Microsoft Accounts Despite MFA

Sentire uncovers the GhostCode phishing kit abusing Microsoft OAuth to steal tokens, register attacker devices and access ...

AI checks for vulnerabilities when you submit a PR? GitHub 'AI Scan' now runs without CodeQL configuration

On September 16, 2026, GitHub made its AI-powered Security Scan significantly easier to use.GitHub's 'AI Scan' is a feature that analyzes changes in a Pull Request (PR) using AI to identify security ...
SecurityWeek

In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw

Ransomware developer sentenced to prison on Switzerland, Plugin4Shell attack targets AI coders, organizations warned of SAP flaw.

Researchers escape OpenAI Codex sandbox to run commands on host

Researchers escaped OpenAI's Codex sandbox two ways, one running commands on a developer's machine from its most locked-down mode. OpenAI has patched both.
Security Affairs

Fake LastPass on GitHub Led to an Infostealer That Killed 145 Security Tools

Attackers spoofed LastPass on GitHub, used a Microsoft-signed driver to disable 145 security products, then deployed an ...