Cursor Flaw Enables Code Execution via Malicious Cloned Repositories on Windows
A critical vulnerability in Cursor, an AI-powered code editor, allows arbitrary code execution on Windows when a user opens a cloned repository…
Tag: Supply Chain Security
Closing the Approval Gap in AI-Era Ad Tech Webinar
An on-demand webinar featuring Reflectiz CEO Idan Cohen and Taboola Director of Product Omri Ariav. The session addresses the Approval Gap in…
Closing the Approval Gap in AI-Era Ad Tech: A Webinar Summary
A single approved marketing tag can quietly load fourth-party code your security team has never seen, granting full access to your forms,…
11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot
Cybersecurity researchers at ESET have discovered 11 old, Microsoft-signed UEFI shim bootloaders that could be exploited to bypass Secure Boot protections on…
Dormant GitHub ‘Ghost’ Accounts Used in Coordinated Reconnaissance Campaigns
Datadog Security Labs has uncovered several overlapping campaigns that leverage dormant GitHub accounts—some created two to five years ago—to systematically enumerate corporate…
Datadog Security Labs Uncovers GitHub Reconnaissance Campaigns
Datadog Security Labs identified campaigns using dormant GitHub accounts for corporate reconnaissance, highlighting risks in API usage and supply chain security.
npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk
GitHub has officially released npm version 12, introducing significant security changes to reduce software supply chain risks. The most notable change is…
The Summer of Clearinghouses: Why Most Will Fail and What Actually Matters in Open Source Vulnerability Remediation
The cybersecurity landscape is witnessing a surge in vulnerability clearinghouse announcements, but according to this analysis, most will fail because they focus…
Friendly Fire Attack: AI Coding Agents Tricked Into Running Malicious Code
Researchers at the AI Now Institute have published a proof-of-concept attack called 'Friendly Fire' that exploits AI coding agents designed to catch…
GhostApproval Symlink Flaws Let Malicious Repos Execute Code in AI Coding Assistants
Security researchers at Wiz have identified a critical vulnerability pattern, dubbed GhostApproval, affecting six popular AI coding assistants. The flaw allows a…