Code Security

Code Security | News, how-tos, features, reviews, and videos

Unsloth’s model picker had a code-execution problem

Just selecting a model in Unsloth Studio could automatically execute Python code from its repository, potentially exposing credentials, data and model artifacts.

By Shweta Sharma

30 Sep 20264 mins

Artificial IntelligenceCode SecurityDevelopment Tools

Python package security in 2026: How supply chain attacks are targeting your AI development environment

By Anjali Gopinadhan Nair

7 Aug 20265 mins

Code SecurityProgramming LanguagesPython

Top AIs invent same fake PyPl and npm package names

By Maxwell Cooter

24 Jul 20262 mins

Artificial IntelligenceCode SecurityDevelopment Tools

Cisco’s new AI model tells code reviewers where to look for vulnerabilities

By Shweta Sharma

23 Jul 20264 mins

Code SecuritySecurity SoftwareThreat and Vulnerability Management

GitHub Actions hardens checkout security to block ‘pwn request’ attacks

By John E. Dunn

23 Jun 20264 mins

Code SecurityGitHubVersion Control Systems

Articles

AWS Continuum offers devs help with securing code

Continuum is a new service intended to hep developers and security teams secure their own code and that of others too, with a goal of automating remediation.

By Anirban Ghoshal

23 Jun 2026 5 mins

Artificial IntelligenceCode SecuritySecurity

HTTP/2’s speed abused to slow webserver performance in DoS attack

Researchers disclose an HTTP/2 denial-of-service technique affecting major web servers after AI-assisted analysis uncovered a flaw linked to HTTP/2 configurations.

By Shweta Sharma

8 Jun 2026 4 mins

Browser SecurityCyberattacksDDoS

Patching fast and slow: Ruby devs delay to defend against supply chain attack

Installing the latest software updates is often advised — but sometimes it’s safer to sit back and wait.

By Maxwell Cooter

6 Jun 2026 2 mins

Code SecurityDevelopment ToolsSecurity

GitHub Actions abused by Megalodon attack to slip malicious commits into 5,500 repos

Researchers say the campaign abused compromised access tokens and deploy keys to inject malicious GitHub Actions workflows into thousands of public repositories.

By Shweta Sharma

27 May 2026 3 mins

Code SecurityGitHubMalware

TrapDoor malware campaign puts developer workstations in CISO spotlight

Malicious packages across npm, PyPI, and Crates.io show how poisoned developer workflows can become a route into enterprise systems.

By Prasanth Aby Thomas

26 May 2026 4 mins

Code SecurityGitHubMalware

Microsoft releases open-source tools to operationalize AI agent safety

Rampart turns red-team findings into repeatable tests; Clarity documents and validates agent design assumptions before code is written.

By Shweta Sharma

21 May 2026 3 mins

Artificial IntelligenceCode SecuritySecurity

GitHub admits major source code leak after 3,800 internal repositories breached

GitHub blamed the latest in a growing list of hacks claimed by TeamPCP on a poisoned VS Code extension.

By John E. Dunn

21 May 2026 4 mins

Code SecurityGitHubVersion Control Systems

Claude Code is still vulnerable to an attack Anthropic has already fixed

Anthropic’s source code leak revealed a new way to get Claude Code to do things it doesn’t want to.

By Maxwell Cooter

4 Apr 2026 2 mins

Code SecurityDevelopment ToolsVulnerabilities

CERT-EU blames Trivy supply chain attack for Europa.eu data breach

Attackers exploited a vulnerability scanner to steal 350GB of data that they then leaked on the dark web.

By John E. Dunn

4 Apr 2026 4 mins

Cloud SecurityCode SecuritySecurity

OpenAI says Codex Security found 11,000 high-impact bugs in a month

The new AI-driven AppSec tool reportedly uncovered hundreds of critical flaws and thousands of high-severity issues during early testing.

By Shweta Sharma

9 Mar 2026 4 mins

Code SecuritySecurity

Anthropic’s Claude Code Security rollout is an industry wakeup call

When Anthropic announced the start of testing on Friday, security vendors, and the markets, sat up and took notice. But is the panic warranted?

By Evan Schuman

24 Feb 2026 9 mins

Artificial IntelligenceCode SecuritySecurity

AI in CI/CD pipelines can be tricked into behaving badly

Malicious content in issues or pull requests can trick AI agents in CI/CD workflows into running privileged commands in an attack researchers nicknamed PromptPwnd.

By Shweta Sharma

6 Dec 2025 4 mins

CI/CDCode SecurityDevops

View all

Unsloth’s model picker had a code-execution problem

GitLab issue email’s only security is obscurity

GitHub App keys can still enable takeovers long after they are forgotten

New npm malware finds a way around install script defenses

Exposed Vite servers are being probed for AWS and Azure credentials

Python package security in 2026: How supply chain attacks are targeting your AI development environment

Top AIs invent same fake PyPl and npm package names

Cisco’s new AI model tells code reviewers where to look for vulnerabilities

GitHub Actions hardens checkout security to block ‘pwn request’ attacks

Articles

AWS Continuum offers devs help with securing code

HTTP/2’s speed abused to slow webserver performance in DoS attack

Patching fast and slow: Ruby devs delay to defend against supply chain attack

GitHub Actions abused by Megalodon attack to slip malicious commits into 5,500 repos

TrapDoor malware campaign puts developer workstations in CISO spotlight

Microsoft releases open-source tools to operationalize AI agent safety

GitHub admits major source code leak after 3,800 internal repositories breached

Claude Code is still vulnerable to an attack Anthropic has already fixed

CERT-EU blames Trivy supply chain attack for Europa.eu data breach

OpenAI says Codex Security found 11,000 high-impact bugs in a month

Anthropic’s Claude Code Security rollout is an industry wakeup call

AI in CI/CD pipelines can be tricked into behaving badly

Resources

The business value of AI for IT solutions

Modernize IT services and operations with AI

Reimagine your IT with AI automation