GPT-5.6 found a WordPress RCE for $25. The expensive part came next
GPT-5.6 Sol Ultra found a pre-authentication WordPress RCE in a multi-agent research run. The AI part was cheap, verifying and disclosing it wasn't.
Elastic found malware hidden in SVG flags. The working coding test was the real trap
A DPRK-aligned campaign used functional Next.js coding tests to deliver credential stealers and a remote-access trojan from payload fragments hidden in SVG files.
Cursor can run a repository's `git.exe`. It says the repo is the trust boundary
Mindgard reported Cursor's git.exe code execution flaw in December 2025. Seven months later, Cursor calls it out of scope and points to Workspace Trust.
npm 12 blocked --ignore-scripts bypasses. Jscrambler's compromise found another way in three days
A compromised Jscrambler npm release ran an infostealer from a preinstall hook, then moved the same payload into normal package code once npm 12 disabled scripts by default.
How Reddit trolls poisoned DuckDuckGo's AI search results
DuckDuckGo's AI answered a false-premise query about Trump dying of rabies. Here's how Reddit fiction became fake local news, became retrieval material, and landed as a confident AI answer.
LastPass confirms another customer data breach. Developers react: “Again?”
LastPass confirmed attackers accessed customer names, contact details, and CRM records after compromising Klue, a third-party sales intelligence tool. The vault is safe. Developers don't care.
An XSS in a low-priority app can compromise your entire Auth0 tenant
A cross-site scripting flaw in a minor internal app can chain with Auth0's default grant settings to reach other applications and APIs across the same tenant. Here's what the attack looks like and what to fix.
Atomic Arch: what Arch Linux's AUR malware wave means for community package repos
Atomic Arch affected more than 1,500 AUR packages and exposed a familiar problem with community repositories: transparent build files help, but they are not the same thing as a security model.
Hackers asked Meta AI support to hijack Instagram accounts, and it said okay
Hackers used Meta AI to hijack Instagram accounts, raising developer concerns about AI agent permissions and account recovery security.
Hosted vs Self-Hosted VPNs
Most of the advice about VPNs can be overly dramatic.
On the one hand there are people who believe that
