Development Tools

Development Tools | News, how-tos, features, reviews, and videos

Unsloth’s model picker had a code-execution problem

Just selecting a model in Unsloth Studio could automatically execute Python code from its repository, potentially exposing credentials, data and model artifacts.

By Shweta Sharma

Sep 30, 20264 mins

Artificial IntelligenceCode SecurityDevelopment Tools

GitLab issue email’s only security is obscurity

By Shweta Sharma

Sep 25, 20265 mins

Code SecurityCommunications SecurityEmail Security

Z.ai disables coding assistant feature after flaw exposed enterprise code upload risk

By Gyana Swain

Sep 22, 20264 mins

Artificial IntelligenceData and Information SecurityDevelopment Tools

OpenClaw rolls out system-wide overhaul, updates security controls across agent platform

By Gyana Swain

Sep 1, 20264 mins

Artificial IntelligenceDevelopment ToolsSecurity

Zhipu says new coding AI developed advanced cyber skills faster than expected

By Gyana Swain

Aug 17, 20265 mins

Artificial IntelligenceDevelopment ToolsSecurity

Top AIs invent same fake PyPl and npm package names

By Maxwell Cooter

Jul 24, 20262 mins

Artificial IntelligenceCode SecurityDevelopment Tools

Articles

AI coding tool hole illustrates a big problem with human in the loop

The flaw, which impacted Amazon, Anthropic, Google, Cursor and others, let the agent give the human false information on which to make decisions.

By Evan Schuman

Jul 9, 2026 6 mins

Artificial IntelligenceDevelopment ToolsVulnerabilities

Argo CD flaw shows why GitOps infrastructure should be treated as tier zero

The unpatched vulnerability could give attackers a pathway from a compromised pod to broader control over Kubernetes deployments.

By Prasanth Aby Thomas

Jul 2, 2026 4 mins

Development ToolsSecurityVulnerabilities

Sandbox bypass flaws in Cursor IDE highlight prompt injection as an RCE vector

The two vulnerabilities reveal a native flaw in LLMs and AI-assisted IDEs affecting more than just Cursor.

By Lucian Constantin

Jul 1, 2026 5 mins

Artificial IntelligenceDevelopment ToolsVulnerabilities

Patching fast and slow: Ruby devs delay to defend against supply chain attack

Installing the latest software updates is often advised — but sometimes it’s safer to sit back and wait.

By Maxwell Cooter

Jun 5, 2026 2 mins

Code SecurityDevelopment ToolsSecurity

Claude Code has an MCP security problem — and your developers are already using it

Your developers trust their tools. That trust is being exploited.

By Anjali Gopinadhan Nair

Jun 5, 2026 7 mins

Application SecurityData and Information SecurityDevelopment Tools

Attack targeting OpenAI Codex users exposes AI software supply chain risks

The incident highlights how attackers can hide malicious code in software packages that differ from the source code available for review.

By Prasanth Aby Thomas

Jun 2, 2026 4 mins

Artificial IntelligenceDevelopment ToolsVulnerabilities

As AI speeds coding, CVE Lite CLI keeps security deliberately AI-free

The OWASP-backed tool scans JavaScript and TypeScript lockfiles locally, aiming to help developers catch and remediate dependency risks before CI failures.

By Shweta Sharma

May 25, 2026 6 mins

Artificial IntelligenceDevelopment ToolsSecurity

AntV data visualization tool the latest to be hit by ongoing npm supply chain attacks

The largest incident yet is a warning that developers should urgently check package security, say experts.

By John E. Dunn

May 19, 2026 4 mins

BusinessCyberattacksEnterprise

13 new critical holes in JavaScript sandbox allow execution of arbitrary code

Developers are urged to upgrade to latest version of the vm2 library to plug all vulnerabilities.

By Howard Solomon

May 7, 2026 5 mins

Development ToolsJavaScriptProgramming Languages

SAP npm package attack highlights risks in developer tools and CI/CD pipelines

Researchers say the campaign targeted developer credentials and cloud secrets while abusing trusted publishing and AI coding tool configurations.

By Prasanth Aby Thomas

Apr 30, 2026 4 mins

CyberattacksCybercrimeDevelopment Tools

Critical Cursor bug could turn routine Git into RCE

A flaw in Cursor’s AI agent lets malicious repositories trigger arbitrary code execution through routine Git operations, now patched in version 2.5.

By Shweta Sharma

Apr 28, 2026 4 mins

Development ToolsSecurityVulnerabilities

View all

Unsloth’s model picker had a code-execution problem

GitLab issue email’s only security is obscurity

Z.ai disables coding assistant feature after flaw exposed enterprise code upload risk

After spending billions, OpenAI still has gaps in its cybersecurity

A zero-click RCE flaw in AI coding agents could have exposed enterprise systems

Exposed Vite servers are being probed for AWS and Azure credentials

OpenClaw rolls out system-wide overhaul, updates security controls across agent platform

Zhipu says new coding AI developed advanced cyber skills faster than expected

Top AIs invent same fake PyPl and npm package names

Articles

AI coding tool hole illustrates a big problem with human in the loop

Argo CD flaw shows why GitOps infrastructure should be treated as tier zero

Sandbox bypass flaws in Cursor IDE highlight prompt injection as an RCE vector

Patching fast and slow: Ruby devs delay to defend against supply chain attack

Claude Code has an MCP security problem — and your developers are already using it

Attack targeting OpenAI Codex users exposes AI software supply chain risks

As AI speeds coding, CVE Lite CLI keeps security deliberately AI-free

AntV data visualization tool the latest to be hit by ongoing npm supply chain attacks

13 new critical holes in JavaScript sandbox allow execution of arbitrary code

SAP npm package attack highlights risks in developer tools and CI/CD pipelines

More fake extensions linked to GlassWorm found in Open VSX code marketplace

Critical Cursor bug could turn routine Git into RCE

Resources

Managing modern identity complexity and reducing executive risk

The new era of executive risk: Why identity security must be continuous

5 identity security questions CISOs must be ready to answer

Video on demand

The Rust language: Developing safer software