Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers

PyPI Package 'Lightning' Compromised in Supply Chain Attack Affecting AI/ML Developers

The PyPI package 'lightning', a widely-used deep learning framework, was compromised in a supply chain attack affecting versions 2.6.2 and 2

Critical Security Alert: Malicious Credential-Stealing File Found in litellm 1.82.8 PyPI Package

The article reports a critical security vulnerability in the litellm==1.82.8 Python package on PyPI, which contains a malicious .pth file th

The case for GitHub Actions security after recent supply chain attacks

PyPI Supply Chain Attacks Expand: New Malicious Packages Target Bioinformatics and MCP Developers

Socket Threat Research team identified a new wave of PyPI supply chain attacks (Mini Shai-Hulud, Miasma, and Hades) that has expanded beyond

Critical RCE vulnerability CVE-2026-3854 discovered in GitHub's internal git infrastructure

Wiz Research discovered a critical vulnerability (CVE-2026-3854) in GitHub's internal git infrastructure affecting both GitHub.com and GitHu

Security Analysis: CodeRabbit Vulnerability Led to RCE and Access to 1 Million Repositories

A detailed security disclosure explaining how researchers achieved remote code execution on CodeRabbit's production servers, leaked API toke