# open-source-security Published articles for open-source-security. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Open Secure AI Alliance Joins the Linux Foundation to Build a Shared, Open Defense Stack for the AI Era DevFeed: [Open Secure AI Alliance Joins the Linux Foundation to Build a Shared, Open Defense Stack for the AI Era]() Original publisher: [Read original article]() Author: andrewb@proximabiz.com (The Linux Foundation) Published: 2026-09-14T16:00:00Z Content type: news Language: en Sources: [Linux Foundation - Blog]() Topics: [Linux](), [Artificial Intelligence](), [Securing AI](), [open-source-security](), [Cybersecurity](), [Security](), [Resilience](), [Inference]() Tags: [ai](), [ai-security](), [collaboration](), [cybersecurity](), [governance](), [infrastructure](), [linux](), [models](), [nvidia](), [open-source](), [open-source-security](), [open-source-software](), [resilience](), [security](), [september-2026](), [standards]() ### AI overview The Open Secure AI Alliance has joined the Linux Foundation under neutral governance. It aims to help organizations collaborate on open AI security tools, research, shared standards, and verifiable defenses spanning models, inference, agents, identity, policy, enforcement, containment, and infrastructure. ### Source excerpt Originally founded by dozens of enterprise leaders and NVIDIA, the Alliance moves to neutral governance to expand industry collaboration on open AI security tools, research and shared defenses ## MinIO End of Life: How to Stay Patched and Audit-Ready with Docker ELS DevFeed: [MinIO End of Life: How to Stay Patched and Audit-Ready with Docker ELS]() Original publisher: [Read original article]() Author: Vishrut Iyengar Published: 2026-08-24T13:00:00Z Content type: article Language: en Sources: [Docker]() Topics: [Docker Hardened Images](), [open-source-security](), [Security](), [migration](), [Docker](), [Open Source](), [Go]() Tags: [community](), [docker](), [docker-hardened-images](), [enterprise](), [go](), [migration](), [open-source](), [open-source-security](), [production](), [products](), [releases](), [security](), [solutions]() ### AI overview Docker's Extended Lifecycle Support keeps MinIO patched and audit-ready after the project's upstream end of life. The article explains how Docker maintains hardened images, tracks CVEs across MinIO and its Go dependencies, backports fixes, and supports teams that cannot immediately migrate their production object storage. ### Source excerpt MinIO reached end of life in February 2026. Docker Extended Lifecycle Support (ELS) keeps end-of-life software like it patched, compliant, and audit-ready for up to five years, covering versions upstream no longer supports all the way up to entire projects. ## A First Look at Evo Agentic AppSec: Agentic Remediation and Malicious Code Defense DevFeed: [A First Look at Evo Agentic AppSec: Agentic Remediation and Malicious Code Defense]() Original publisher: [Read original article]() Author: Brendan Hann Published: 2026-08-04T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [AI Bots]() Tags: [agent](), [agentic](), [ai](), [ai-agents](), [ai-security](), [application-security](), [aspm](), [autonomous](), [blog](), [cli](), [code-security](), [developer](), [devops](), [interest](), [javascript](), [node-js](), [open-source-security](), [pull-request](), [python](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [vulnerabilities](), [vulnerability-insights]() ### AI overview Snyk introduces Evo Agentic AppSec capabilities for automatically remediating vulnerabilities and blocking malicious packages before they reach code. The Remediation Agent triages issues, creates and checks fixes, and opens pull requests for review. ### Source excerpt Explore Snyk's first Agentic AppSec capabilities: an autonomous Remediation Agent that fixes vulnerabilities and Malicious Code Defense that blocks risky packages before they ship. ## Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks DevFeed: [Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks]() Original publisher: [Read original article]() Author: Liran Tal; Lion Kontorer Published: 2026-08-04T04:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident](), [releases]() Tags: [awareness](), [blog](), [ci](), [ci-cd](), [code](), [developer](), [devops](), [embedded](), [enablement](), [ide](), [incident](), [javascript](), [malware](), [manifest](), [node-js](), [npm-packages](), [open-source-security](), [payload](), [persistence](), [releases](), [research](), [scm](), [secrets](), [security](), [security-labs](), [snyk-learn](), [snyk-open-source](), [snyk-security-intel](), [software](), [supply-chain](), [supply-chain-security](), [vulnerability-insights]() ### AI overview Snyk reports an active supply-chain incident in which keyv 6.0.0 and ten related npm releases contained install-time malware. The article describes the malicious preinstall hook, its second-stage payload, affected-release investigation, and remediation guidance. ### Source excerpt keyv 6.0.0 and ten related npm releases shipped install-time malware. See affected versions, hashes, detection steps, and safe remediation order. ## Why Appsec Teams Need Internal Developer Portals DevFeed: [Why Appsec Teams Need Internal Developer Portals]() Original publisher: [Read original article]() Author: Yonatan Boguslavski Published: 2026-07-30T10:09:05Z Content type: article Language: en Sources: [Developer Experience & Platform Engineering Blog | Port]() Topics: [internal developer portal](), [Application Security](), [Platform Engineering](), [sdlc](), [Vulnerabilities](), [Security]() Tags: [application-security](), [cognitive-load](), [dependency](), [developer-portal](), [internal-developer-portal](), [open-source-security](), [platform-engineering](), [security](), [vulnerabilities](), [vulnerability]() ### AI overview The article explains how internal developer portals can help AppSec teams support self-sufficient developers by consolidating vulnerability and misconfiguration data from multiple security tools and software development stages. By providing security information in context through catalogs, self-service remediation actions, and scorecards, portals can reduce cognitive load and dependency on AppSec teams. ### Source excerpt If you want self-sufficient developers working in a "you build it you own it" world, you need an internal developer portal. ## The Attacker Never Sleeps, Neither Can Your Testing DevFeed: [The Attacker Never Sleeps, Neither Can Your Testing]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2026-07-30T00:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [AI-assisted coding](), [Developer Tools]() Tags: [agents](), [ai](), [application-security](), [awareness](), [blog](), [code](), [code-security](), [devops](), [devsecops](), [executive](), [finserv](), [interest](), [open-source-security](), [security](), [snyk-apprisk](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [software](), [supply-chain-security](), [tech](), [testing](), [vulnerability-insights]() ### AI overview AI-driven code generation is expanding software attack surfaces while giving attackers machine-speed reasoning capabilities. The article argues that security teams need continuous testing, agent governance, and independent validation of findings. ### Source excerpt AI is accelerating software development and giving attackers machine-speed capabilities. Security teams must continuously test AI-built code, govern agents, and independently validate every finding. ## Growing up the hard way DevFeed: [Growing up the hard way]() Original publisher: [Read original article]() Published: 2026-07-22T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [open-source-security](), [ai regulation](), [Artificial Intelligence](), [Security]() Tags: [chainguard-software-supply-chain-security](), [open-source](), [open-source-security](), [open-source-software](), [oss](), [security](), [shai-hulud](), [software-supply-chain-security](), [solarwinds](), [supply-chain](), [teampcp]() ### AI overview This opinion argues that open source is entering a difficult transition after supply-chain incidents, regulatory pressure, and the industrialization of malware. It forecasts that the Open Source definition will remain intact while enterprise and regulatory requirements change which open source software organizations are willing or permitted to consume, with AI-driven vulnerability discovery and poisoned distribution channels creating pressure on both fronts. ### Source excerpt Open source is growing up. Explore why AI, regulation, and enterprise security are reshaping how organizations consume open source software. ## NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence DevFeed: [NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence]() Original publisher: [Read original article]() Author: Michelle Ginzburg; Noa Yaffe-Ermoza Published: 2026-06-25T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [open-source-security](), [Security](), [data]() Tags: [ai](), [article](), [awareness](), [developer](), [devops](), [interest](), [open-source](), [open-source-security](), [security](), [snyk-open-source](), [snyk-security-intel](), [software](), [supply-chain-security](), [technology](), [vulnerability](), [vulnerability-insights]() ### AI overview The article explains why vulnerability intelligence is moving beyond reliance on the National Vulnerability Database. It describes NIST's shift toward prioritized triage and presents Snyk's multi-source approach, combining vulnerability advisories, analyst validation, internal enrichment, open-source context, and multiple risk assessments to help teams prioritize remediation. ### Source excerpt NIST's shift to risk-based enrichment makes one thing clear: modern security teams need more than a single public source. In the AI era, trusted vulnerability intelligence depends on multiple signals, human validation, and clear context. ## The full Snyk AI Security Platform, free for open source maintainers DevFeed: [The full Snyk AI Security Platform, free for open source maintainers]() Original publisher: [Read original article]() Author: Brendan Hann Published: 2026-06-18T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Maintainers](), [Open Source](), [Security](), [vulnerability](), [open-source-security](), [Artificial Intelligence](), [Frontier Model](), [Remote Access Trojan](), [AI Infrastructure]() Tags: [agent](), [ai](), [ai-infrastructure](), [ai-security](), [article](), [awareness](), [bugs](), [developer](), [enablement](), [engineering](), [frontier-model](), [interest](), [maintainers](), [open-source](), [open-source-security](), [remote-access-trojan](), [security](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-team](), [software](), [supply-chain-security](), [vulnerability](), [vulnerability-insights]() ### AI overview Snyk's Secure Developer Program gives qualifying open source projects free access to the Snyk AI Security Platform. It is designed to help maintainers prioritize real vulnerability reports and produce validated, merge-ready fixes through the Snyk Remediation Agent. ### Source excerpt Open source maintainers are drowning in real vulnerability reports and need help prioritizing, fixing, and shipping remediation faster. Snyk's Secure Developer Program gives qualifying projects free access to the Snyk AI Security Platform. ## A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope DevFeed: [A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope]() Original publisher: [Read original article]() Author: Liran Tal; Marian Corneci Published: 2026-06-16T21:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident]() Tags: [awareness](), [blog](), [ci-cd](), [cross-platform](), [cryptocurrency](), [developer](), [devops](), [devrel](), [devsecops](), [incident](), [javascript](), [node-js](), [open-source-security](), [payload](), [persistence](), [remote-access-trojan](), [sbom](), [scm](), [secrets](), [security](), [snyk-open-source](), [supply-chain](), [supply-chain-security](), [tech](), [tls](), [vulnerability-insights]() ### AI overview A dormant former-contributor npm account was compromised and used to republish the Mastra package scope with a malicious dependency that installs cryptocurrency-stealing malware and a persistent remote-access trojan. The article describes the stale access control that enabled the supply-chain incident and advises treating affected installations as credential and wallet exposure events. ### Source excerpt A dormant contributor account was used to republish the entire @mastra npm scope, each injected with a single dependency, easy-day-js, that drops a cross-platform cryptocurrency stealer. Here is how the attack worked, how to check exposure, and how to remediate. ## Google joins the Eclipse Foundation as a strategic member to accelerate AI-integrated developer tools DevFeed: [Google joins the Eclipse Foundation as a strategic member to accelerate AI-integrated developer tools]() Original publisher: [Read original article]() Author: Google Open Source (noreply@blogger.com) Published: 2026-06-10T18:30:00Z Content type: news Language: en Sources: [Google Open Source Blog]() Topics: [Google](), [Open Source](), [Artificial Intelligence](), [dev-tools](), [google-antigravity](), [Extension](), [Critical Infrastructure]() Tags: [ai](), [ai-integrated](), [antigravity](), [critical-infrastructure](), [developer-tools](), [eclipse-foundation](), [google](), [google-ospo](), [open-source](), [open-source-security]() ### AI overview Google joined the Eclipse Foundation as a Strategic Member in April 2026. It will sponsor Open VSX, participate in the foundation's governance, and support open infrastructure for AI-integrated developer platforms, along with open source security and regulatory compliance initiatives. ### Source excerpt by amanda casari & Mike Bufano, Google Open Source Collaboration with the Eclipse Foundation will support open infrastructure for AI-integrated developer platforms like Google Antigravity, while advancing broader open source security and regulatory compliance initiatives As of April 2026, Google has joined the Eclipse Foundation as a Strategic Member, reflecting the company's continued investment in open source technologies and modern developer infrastructure. As part of this collaboration, Google will additionally sponsor Open VSX and is among the first adopters of the recently announced Open VSX Managed Registry service. Open VSX is the open source, vendor-neutral extension registry for tools built on the VS Code™ extension API. It powers a rapidly growing ecosystem of AI-integrated IDEs, cloud development environments, and developer platforms, including Google Antigravity, AWS's Kiro, Cursor, and, Windsurf among many others. As a Strategic Member, Google will participate in the Eclipse Foundation's Board of Directors and Technical Advisory Council, helping guide the technical and strategic direction of one of the world's leading open source software foundations. "The industry is feeling the massive turning point as AI continues to change how developers write, deploy, and maintain software," said amanda casari of Google's Open Source Programs Office and new Eclipse Board member. "Joining The Eclipse Foundation as a Strategic Member ensures that the next generation of AI-integrated developer experiences--including platforms like Google Antigravity--are built in partnership with transparent, vendor-neutral foundations. Open registries, like Open VSX, are critical infrastructure which keep the global developer ecosystem open to everyone." Google and the Eclipse Foundation share a deep history, having collaborated across numerous initiatives since 2006. This Strategic Membership elevates the relationship and support critical to modern initiatives like Open VSX, Open Reg ## Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp DevFeed: [Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp]() Original publisher: [Read original article]() Author: Liran Tal Published: 2026-06-04T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [npm](), [Malware](), [Security](), [GitHub Actions](), [GitHub](), [Maintainers]() Tags: [awareness](), [blog](), [ci-cd](), [container-security](), [developer](), [devops](), [devsecops](), [eslint](), [github](), [github-actions](), [javascript](), [maintainers](), [malware](), [node](), [node-js](), [open-source-security](), [payload](), [persistence](), [scm](), [secrets](), [security](), [snyk-open-source](), [supply-chain](), [supply-chain-security](), [tech](), [vulnerability-insights]() ### AI overview Snyk reports a critical npm supply-chain compromise in which a weaponized binding.gyp file abuses node-gyp during installation to execute malicious code without relying on lifecycle scripts. The worm affects 57 packages, harvests developer and CI/CD credentials, exfiltrates them through GitHub repositories, injects GitHub Actions workflows for persistence, and republishes packages accessible through compromised maintainer accounts. ### Source excerpt A new npm worm is abusing binding.gyp to trigger node-gyp during install, letting malicious packages run code without lifecycle scripts. It steals credentials, persists in GitHub, and self-propagates across maintainers. ## Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection DevFeed: [Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection]() Original publisher: [Read original article]() Author: Brian Vermeer Published: 2026-06-02T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [prompt injection](), [agentic-coding](), [AI-assisted coding](), [Open Source](), [Command-line interface](), [Maven](), [CI/CD](), [payload](), [Claude Code](), [cursor](), [GitHub Copilot]() Tags: [agentic-coding](), [agents](), [ai](), [ai-agents](), [ai-coding](), [article](), [awareness](), [ci-cd](), [claude-code](), [code](), [copilot](), [cursor](), [developer](), [devops](), [github](), [interest](), [java](), [open-source](), [open-source-security](), [payload](), [prompt-injection](), [sandbox](), [scm](), [security](), [security-labs](), [snyk-code](), [snyk-open-source](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [testing](), [tools](), [vulnerability-insights]() ### AI overview The article examines jqwik 1.10.0, whose maintainer embedded a prompt injection in test output aimed at AI coding agents. ANSI terminal escape codes concealed the instruction from humans while leaving it visible to tools processing raw logs, creating a supply-chain risk for CI/CD pipelines and agentic coding workflows. ### Source excerpt jqwik 1.10.0 added a hidden prompt injection aimed at AI coding agents, using terminal escape codes to conceal destructive instructions from humans while leaving them readable to logs and tools. ## AI-driven zero-day combinations are challenging software security and open-source consumption DevFeed: [AI-driven zero-day combinations are challenging software security and open-source consumption]() Original publisher: [Read original article]() Published: 2026-05-28T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Artificial Intelligence](), [open-source-security](), [Security](), [Open Source](), [Machine Learning, Security Attacks](), [Critical Infrastructure](), [openssf](), [sigstore]() Tags: [ai](), [anthropic-mythos](), [chainguard-containers](), [critical-infrastructure](), [fork](), [mfa](), [mythos](), [open-source](), [open-source-security](), [openssf](), [oss](), [project-glasswing](), [rust](), [sast](), [secure-open-source](), [security](), [sigstore]() ### AI overview The article argues that Mythos represents a potential new class of software-security threat: AI-driven combinations of existing issues that can produce more serious attacks than individual scanner findings. It discusses the limits of government regulation and calls for stronger trust infrastructure, coordinated disclosure, and safer open-source consumption. ### Source excerpt Mythos is changing software security fast. AI-driven zero-days demand new trust infrastructure, coordinated disclosure, and secure open source consumption. ## TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack DevFeed: [TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-05-11T05:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident]() Tags: [article](), [attacks](), [cache](), [ci-cd](), [cryptographic](), [developer](), [devops](), [devsecops](), [github](), [github-actions](), [identity](), [incident](), [maintainers](), [memory](), [npm-packages](), [open-source-security](), [sbom](), [scm](), [security](), [snyk-open-source](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [teampcp](), [tech](), [toolchain](), [vulnerability-insights](), [workflow]() ### AI overview TanStack's legitimate release pipeline was hijacked to publish malicious npm packages with valid SLSA provenance. The article describes the Mini Shai-Hulud supply-chain attack, its impact, and remediation guidance to rotate secrets on affected install environments. ### Source excerpt On May 11, 2026, the Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 @tanstack/* packages (as well as @squawk/*, @mistralai/* packages, and others) by chaining a GitHub Actions "Pwn Request," cache poisoning, and OIDC token extraction from runner memory -- producing the first npm supply chain attack with valid SLSA Build Level 3 attestations. Here's what happened, what was stolen, and what you need to do right now. ## lightning PyPI Compromise: A Bun-Based Credential Stealer in Python DevFeed: [lightning PyPI Compromise: A Bun-Based Credential Stealer in Python]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-04-30T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Malware](), [Python](), [Bun](), [JavaScript](), [GitHub](), [snyk-learn](), [npm](), [releases]() Tags: [article](), [awareness](), [ci-cd](), [code](), [developer](), [devops](), [github](), [javascript](), [open-source-security](), [payload](), [python](), [release](), [sbom](), [secrets](), [security](), [security-labs](), [snyk-learn](), [snyk-open-source](), [snyk-security-intel](), [supply-chain-security](), [tech](), [vulnerability-insights]() ### AI overview A compromised lightning PyPI release downloads the Bun JavaScript runtime at import time and executes an approximately 11 MB obfuscated credential stealer. The article covers the package compromise, Snyk advisory, remediation, and similarities to the preceding Mini Shai-Hulud npm campaign. ### Source excerpt A malicious release of the lightning PyPI package ships a credential-stealing Bun payload that runs on import. Snyk has a live advisory. Here's what's in the package, what to rotate, and how the payload pattern connects to the Mini Shai-Hulud npm campaign one day earlier. ## "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages DevFeed: ["A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-04-29T00:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident](), [releases]() Tags: [article](), [awareness](), [ci-cd](), [developer](), [devops](), [ecosystem](), [github](), [github-actions](), [incident](), [interest](), [javascript](), [node-js](), [npm-packages](), [open-source-security](), [payload](), [releases](), [sap](), [scm](), [security](), [snyk-open-source](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [tech](), [tool](), [toolchain](), [vulnerability-insights]() ### AI overview A supply-chain attack compromised four npm packages in the SAP development ecosystem. Malicious releases download Bun and execute an obfuscated credential stealer, while SAP published clean post-incident versions and Snyk issued advisories. ### Source excerpt A new npm supply chain attack self-branded "Mini Shai-Hulud" compromised four SAP-ecosystem packages on April 29, 2026. Snyk has live advisories. Here's the technical breakdown, IOCs, and what to do. ## Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining DevFeed: [Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining]() Original publisher: [Read original article]() Author: Julia Kinday Published: 2026-04-27T00:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [incident](), [Security](), [Express](), [GitHub Issues](), [Docker](), [GitHub](), [Open Source](), [Server](), [Shell](), [JavaScript](), [npm]() Tags: [application-security](), [attacks](), [auth](), [authentication](), [awareness](), [blog](), [ci-cd](), [cloud](), [cloud-security](), [code](), [developer](), [devops](), [docker](), [enablement](), [github](), [github-issues](), [incident](), [javascript](), [malware](), [node-js](), [open-source](), [open-source-security](), [routing](), [security](), [security-labs](), [self-hosted](), [servers](), [snyk-code](), [snyk-container](), [snyk-learn](), [snyk-open-source](), [snyk-security-intel](), [tech](), [typescript](), [vulnerabilities](), [vulnerability]() ### AI overview Qinglong, an open-source self-hosted task scheduling panel, was exploited through two authentication bypass vulnerabilities affecting versions 2.20.1 and earlier. Attackers used unauthenticated remote code execution to deploy cryptocurrency miners on publicly accessible installations. The article describes the vulnerabilities, their Express.js routing and middleware flaws, and the impact on operators using cloud VPS instances and home servers. ### Source excerpt Two authentication bypass vulnerabilities (CVE-2026-3965, CVE-2026-4047) in the Qinglong task scheduling panel were exploited in the wild to deploy cryptomining malware. Here's what happened, how the attacks worked, and what self-hosted application operators should learn from this incident. ## JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up? DevFeed: [JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up?]() Original publisher: [Read original article]() Author: John Carione Published: 2026-04-23T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Resilience](), [Security](), [snyk-iac](), [supply-chain-security](), [vulnerability](), [Infrastructure as code](), [Open Source](), [AI Development](), [releases](), [pull-requests](), [Code]() Tags: [ai](), [ai-development](), [awareness](), [blog](), [cloud-security](), [code](), [contentlab](), [developer](), [devops](), [executive](), [iac-security](), [interest](), [open-source](), [open-source-security](), [pull-requests](), [releases](), [resilience](), [sbom](), [secrets](), [security](), [snyk-cloud](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-security-intel](), [supply-chain-security](), [vulnerability]() ### AI overview JPMorganChase's 10-point cyber resilience checklist addresses enterprise security priorities spanning software versions, open-source dependencies, SBOMs, build pipelines, secrets, infrastructure as code, and AI development. The article explains how Snyk covers eight of the ten actions through developer workflows and its security platform. ### Source excerpt JPMorganChase published a 10-point cyber resilience checklist. See how Snyk covers 8 of the 10 actions and where it fits in your security stack. ## Accelerating the cyber defense ecosystem that protects us all DevFeed: [Accelerating the cyber defense ecosystem that protects us all]() Original publisher: [Read original article]() Published: 2026-04-16T00:00:00Z Content type: article Language: en Sources: [OpenAI News]() Topics: [OpenAI](), [Cybersecurity](), [supply-chain-security](), [open-source-security](), [Vulnerabilities](), [Critical Infrastructure](), [Open Source](), [API](), [Cloudflare](), [Nvidia]() Tags: [api](), [critical-infrastructure](), [cybersecurity](), [developers](), [enterprise](), [global](), [gpt](), [infrastructure](), [open-source](), [open-source-security](), [openai](), [security](), [vulnerabilities]() ### AI overview OpenAI describes Trusted Access for Cyber, a program intended to expand access to advanced cybersecurity capabilities according to trust, validation, and safeguards. It is providing $10 million in API credits through a Cybersecurity Grant Program to help security teams, vulnerability researchers, maintainers, enterprises, and other defenders strengthen software supply chain security and vulnerability research. ### Source excerpt Leading security firms and enterprises join OpenAI's Trusted Access for Cyber, using GPT-5.4-Cyber and $10M in API grants to strengthen global cyber defense. ## Chainguard Libraries is now free until June 30, 2026 -- no commitment required DevFeed: [Chainguard Libraries is now free until June 30, 2026 -- no commitment required]() Original publisher: [Read original article]() Published: 2026-04-09T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [open-source-security](), [Security](), [Malware](), [Java](), [JavaScript](), [Python]() Tags: [2026](), [article](), [attacks](), [axios](), [chainguard-console](), [chainguard-libraries](), [chainguard-repository](), [code](), [dependency](), [free](), [install](), [java](), [javascript](), [libraries](), [library](), [litellm](), [malicious-packages](), [malware](), [open-source](), [open-source-packages](), [open-source-security](), [packages](), [rebuilds](), [software-supply-chain-security](), [telnyx](), [trivy-attack]() ### AI overview Chainguard Libraries is free for Chainguard console users until June 30, 2026, with no paid commitment required. It rebuilds Python, Java, and JavaScript packages from verified source in isolated environments and excludes libraries that use install-time scripts, helping reduce malware and software supply-chain risk. ### Source excerpt Open source attacks are rising. Chainguard Libraries rebuilds packages from verified source to block malware--now free until June 30, 2026. ## Supply chain attacks expose weaknesses in open-source software trust DevFeed: [Supply chain attacks expose weaknesses in open-source software trust]() Original publisher: [Read original article]() Published: 2026-04-09T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [vulnerability](), [Exploit](), [npm]() Tags: [ai-coding](), [attacks](), [chainguard](), [code](), [dependency](), [hardening](), [npm](), [open-source](), [open-source-security](), [oss](), [pypi](), [scanner](), [secrets](), [software-supply-chain-security](), [solarwinds](), [supply-chain](), [supply-chain-attacks](), [trust](), [vibe-coding](), [vulnerability](), [vulnerability-scanner]() ### AI overview This opinion article argues that a series of open-source supply chain attacks exposed a broken trust model. It discusses attacks involving npm and PyPI packages, stolen credentials, malicious contributors, and the limits of vulnerability scanning and hardening. ### Source excerpt Five supply chain attacks in 12 days exposed a broken trust model. Learn why scanning and hardening fail, and why trusting the source is the only fix. ## You Patched LiteLLM, But Do You Know Your AI Blast Radius? DevFeed: [You Patched LiteLLM, But Do You Know Your AI Blast Radius?]() Original publisher: [Read original article]() Author: Rudy Lai Published: 2026-04-02T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Artificial Intelligence](), [Large Language Model](), [Security](), [Malware](), [Open Source](), [incident](), [data](), [App](), [Code]() Tags: [agent](), [ai](), [apis](), [application-security](), [applications](), [awareness](), [blog](), [code](), [code-security](), [data](), [incident](), [interest](), [llm](), [malware](), [open-source](), [open-source-security](), [pmm](), [security](), [supply-chain-security](), [tools](), [vulnerability-insights](), [workflows]() ### AI overview LiteLLM, an open-source gateway routing requests to more than 100 LLM providers, was compromised with credential-stealing malware. The incident exposed how connected models, APIs, tools, agent workflows, and sensitive data can expand an AI system's blast radius. ### Source excerpt The LiteLLM compromise showed AI risk extends beyond dependencies. Use Evo AI-SPM to map your full AI blast radius, securing connected models, tools, and agent workflows.1 ## How to protect your organization from the telnyx PyPI compromise DevFeed: [How to protect your organization from the telnyx PyPI compromise]() Original publisher: [Read original article]() Published: 2026-03-27T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Malware](), [open-source-security](), [SDKs](), [C2](), [Python](), [API keys](), [Encryption](), [Open Source](), [chainguard](), [ssh](), [GitHub Actions]() Tags: [api-keys](), [c2](), [chainguard](), [chainguard-libraries](), [encryption](), [github-actions](), [malware](), [open-source-security](), [pypi](), [pypi-attack](), [pypi-compromise](), [rsa](), [security](), [ssh](), [supply-chain](), [teampcp](), [telnyx](), [telnyx-attack](), [telnyx-compromise](), [trivy]() ### AI overview The article explains that malicious versions 4.87.1 and 4.87.2 of the Telnyx Python SDK were published to PyPI after publishing credentials were compromised. The malware executes at module scope, downloads from a remote C2 server, and uses a WAV file to conceal a Windows persistence binary or credential harvester for Linux and macOS. It recommends immediate removal, version pinning, credential rotation, and persistence checks. The article also attributes the attack to TeamPCP and connects it to a broader coordinated supply chain campaign. ### Source excerpt Malicious telnyx versions hit PyPI in a wider supply chain attack. Chainguard customers stayed protected by using source-built, verified libraries. [Next page]()