The popular Python Pickle serialization format, which is common for distributing AI models, offers ways for attackers to inject malicious code that will be executed on computers when loading models with PyTorch.

By Lucian Constantin

Feb 7, 2025 5 mins

Libraries and FrameworksMalwarePython

Supply chain compromise of Ultralytics AI library results in trojanized versions

Attackers exploited a script injection vulnerability via GitHub Actions to inject malicious code during the automated build process, poisoning the resulting packages of the popular Python library.

By Lucian Constantin

Dec 6, 2024 4 mins

Libraries and FrameworksMalwarePython

New cryptomining campaign infects WebLogic servers with Hadooken malware

The Hadooken backdoor affecting the popular Java app server carries a cryptomining program and links to ransomware.

By Lucian Constantin

Sep 13, 2024 4 mins

Advanced Persistent ThreatsHackingJava

Thousands of abandoned PyPI projects could be hijacked: Report

Software supply chain attacks could increase by using this newly discovered tactic, say JFrog researchers

By Howard Solomon

Sep 4, 2024 6 mins

PythonSoftware DevelopmentVulnerabilities

Formerly legitimate Polyfill.io domain abused to serve malicious code

Enterprises relying on its JavaScript fragments to ensure their web apps’ browser compatibility could be spreading trouble for users.

By John Leyden

Jun 26, 2024 3 mins

JavaScriptVulnerabilitiesWeb Development

Container security: How Waratek blocks Java exploits

Waratek relies on just-in-time compiling and focuses exclusively on one of the biggest security risks within most organizations: applications running Java.

By John Breeden

Jul 31, 2017 6 mins

Application SecurityJavaSecurity

Java and Python FTP attacks can punch holes through firewalls

Hackers can trick Java and Python applications to execute rogue FTP commands that would open ports in firewalls

By Lucian Constantin

Feb 21, 2017 5 mins

JavaSecuritySoftware Development

Black Hat: 9 free security tools for defense & attacking

Some of the researchers who at Black Hat will show how they hack and release the tools they used to do it

By Tim Greene

Jul 29, 2016 6 mins

Cisco SystemsGoogleJava

Three-year-old IBM patch for critical Java flaw is broken

Attackers can easily bypass the patch to exploit a vulnerability that allows them to escape from the Java security sandbox

By Lucian Constantin

Apr 5, 2016 3 mins

Application SecurityJavaSecurity

Java installer flaw shows why you should clear your Downloads folder

Older versions of the Java installer were vulnerable to binary planting in the Downloads folder

By Lucian Constantin

Feb 8, 2016 3 mins

JavaSecurity

Oracle is planning to kill an attacker's favorite: the Java browser plug-in

The browser plug-in will be retired in Java 9, but older versions will likely linger on for years

By Lucian Constantin

Jan 28, 2016 3 mins

JavaOracleSecurity

View all

Hundreds of OpenAI agents attack RubyGems platform

Critical flaw patched in popular JavaScript sandbox used in AI projects

Python package security in 2026: How supply chain attacks are targeting your AI development environment

Meet Hades: The malware that lies to AI security agents

Hugging Face Transformers RCE flaw enables stealthy compromise via AI model configs

13 new critical holes in JavaScript sandbox allow execution of arbitrary code

Critical sandbox bypass fixed in popular Thymeleaf Java template engine

Unplugged holes in npm and yarn could let attackers bypass Shai-Hulud defenses

Flaws in Chainlit AI dev framework expose servers to compromise

Articles

Wave of npm supply chain attacks exposes thousands of enterprise developer credentials

Attackers hide malicious code in Hugging Face AI model Pickle files

Supply chain compromise of Ultralytics AI library results in trojanized versions

New cryptomining campaign infects WebLogic servers with Hadooken malware

Thousands of abandoned PyPI projects could be hijacked: Report

Formerly legitimate Polyfill.io domain abused to serve malicious code

Container security: How Waratek blocks Java exploits

Java and Python FTP attacks can punch holes through firewalls

Black Hat: 9 free security tools for defense & attacking

Three-year-old IBM patch for critical Java flaw is broken

Java installer flaw shows why you should clear your Downloads folder

Oracle is planning to kill an attacker's favorite: the Java browser plug-in

Resources

Managing modern identity complexity and reducing executive risk

The new era of executive risk: Why identity security must be continuous

5 identity security questions CISOs must be ready to answer