DevSecOps

GitHub admits major source code leak after 3,800 internal repositories breached

GitHub blamed the latest in a growing list of hacks claimed by TeamPCP on a poisoned VS Code extension.

By John E. Dunn

May 20, 20264 mins

Code SecurityGitHubVersion Control Systems

Contractor’s public GitHub account exposed GovCloud and CISA credentials

By Howard Solomon

May 19, 20266 mins

Data and Information SecurityGitHubVersion Control Systems

AntV data visualization tool the latest to be hit by ongoing npm supply chain attacks

By John E. Dunn

May 19, 20264 mins

BusinessCyberattacksEnterprise

GitHub scales back bug bounties, reminds users security is their responsibility too

By Anirban Ghoshal

May 19, 20265 mins

BugsGitHubVersion Control Systems

Articles

Enterprise Spotlight: Transforming software development with AI

Download the May 2026 issue of the Enterprise Spotlight from the editors of CIO, Computerworld, CSO, InfoWorld, and Network World and learn how to harness the power of AI-enabled development.

By CSO Staff

May 1, 2026 1 min

Application SecurityArtificial IntelligenceDevSecOps

SAP npm package attack highlights risks in developer tools and CI/CD pipelines

Researchers say the campaign targeted developer credentials and cloud secrets while abusing trusted publishing and AI coding tool configurations.

By Prasanth Aby Thomas

Apr 30, 2026 4 mins

CyberattacksCybercrimeDevelopment Tools

Critical Cursor bug could turn routine Git into RCE

A flaw in Cursor’s AI agent lets malicious repositories trigger arbitrary code execution through routine Git operations, now patched in version 2.5.

By Shweta Sharma

Apr 28, 2026 4 mins

Development ToolsSecurityVulnerabilities

Software risk is business risk—now is the time for C-Suite to act

While software introduces new ways of doing business, it can also introduce serious new risks. When it comes to digital transformation, don’t let inherit risks stand in the way of the competitive advantage your business seeks.

By Jason Schmitt, General Manager, Synopsys Software Integrity Group

Mar 13, 2023 4 mins

DevopsSoftware Development

Microsoft taps Anthropic’s Mythos to strengthen secure software development

The move is a clear signal that powerful AI models are making inroads into real software security work.

By Prasanth Aby Thomas

Apr 23, 2026 3 mins

Artificial IntelligenceSecuritySoftware Development

Malicious pgserve, automagik developer tools found in npm registry

Fake packages aim to steal data, credentials, and secrets, and to infect every package created using them, in what could be ‘a complete organizational takeover’.

By Howard Solomon

Apr 22, 2026 7 mins

CybercrimeDevelopment ToolsMalware

Microsoft issues out-of-band patch for critical security flaw in update to ASP.NET Core

Patching is not enough: applications embedding the insecure library will need to be rebuilt, and affected tokens and cookies expired.

By John E. Dunn

Apr 22, 2026 4 mins

Development ToolsSecurityVulnerabilities

Critical sandbox bypass fixed in popular Thymeleaf Java template engine

The 9.1-CVSS vulnerability enables attackers to circumvent RCE protections in the de facto template engine for the Java Spring ecosystem.

By Lucian Constantin

Apr 17, 2026 3 mins

JavaSecurityVulnerabilities

RCE by design: MCP architectural choice haunts AI agent ecosystem

Unsafe defaults in MCP configs open servers to possible remote code execution, as evidenced by several commercial services and open-source projects.

By Lucian Constantin

Apr 16, 2026 7 mins

Application SecurityArtificial IntelligenceSecurity

Internet Bug Bounty program hits pause on payouts

HackerOne is the latest organization to struggle with AI submissions.

By Maxwell Cooter

Apr 3, 2026 2 mins

BugsOpen SourceVulnerabilities

Claude Code is still vulnerable to an attack Anthropic has already fixed

Anthropic’s source code leak revealed a new way to get Claude Code to do things it doesn’t want to.

By Maxwell Cooter

Apr 3, 2026 2 mins

Code SecurityDevelopment ToolsVulnerabilities

Cybersecurity in the age of instant software

As AI advances, the rise of instant, customized, and often ephemeral software solutions will alter the dynamics of vulnerability hunting and patching, and thus the battle between attackers and defenders.

By Bruce Schneier

Apr 2, 2026 10 mins

Artificial IntelligencePatch Management SoftwareSecurity