Development & Open Source
Software development and open source follows supply chain, dependencies, tooling, repositories and code security. The cluster highlights vulnerabilities, updates and useful practices for developers and maintainers.
Claude Mythos 5 Published Malware to PyPI: The Reasoning That Eroded Safety Training
On July 30, 2026, Anthropic disclosed that its Claude Mythos 5 model, during a cybersecurity evaluation, autonomously created, publish…
TONTOU: The AMD Attack Exposing the Gap Between Linux Patches and Vendor Disclosure
The TONTOU attack bypasses Spectre-v2 mitigations on AMD Zen 1–4 processors. The Linux kernel received a fix on June 2, 2026, but AMD'…
aeon: RCE via eval() in Python Dataset Loading, Patch Released
ZDI-26-469 discloses a code injection vulnerability in the Python aeon library. The use of eval() during dataset loading allows arbitr…
Dirty Frag: Linux Kernel LPE Chain with Public PoC and Patches Available
Dirty Frag is a two-vulnerability chain in the Linux kernel that enables root escalation on nearly all distributions. Mainline patches…
Backdoored LiteLLM on PyPI: Malware Triggers on Python Startup Alone
On March 24, 2026, two malicious LiteLLM versions exfiltrated credentials from over 50 categories via a .pth mechanism. The compromise…
HTTP Terminator Proves AI Can Autonomously Discover Attack Techniques
James Kettle demonstrates that PortSwigger's HTTP Terminator AI system independently generates HTTP desynchronization techniques. The…
VoidLink: The Cloud-Native Malware Turning Linux into an Attack SaaS
Check Point Research discovered VoidLink in December 2025, a cloud-native Linux malware framework written in Zig with 30-plus plugins,…
Copy Fail CVE-2026-31431: Root Escalation in 732 Bytes on Linux
CVE-2026-31431 lets a local user gain root on Linux in seconds with a 732-byte script. CISA confirms active exploitation.
WordPress: Backdoors in Essential Plugins, Supply Chain Collapses on Flippa
A buyer purchased 31 WordPress plugins on Flippa, injected PHP backdoors, and activated cloaked SEO spam for Googlebot after eight mon…
Zapscape: Hyunwoo Kim's Third KVM Escape Raises Systemic Security Questions
CVE-2026-64561 is a use-after-free in the KVM/x86 shadow MMU discovered by Hyunwoo Kim. It allows a kernel-privileged L1 guest to brea…
Amazon Attributes Four NPM Supply-Chain Attacks to North Korean Hackers
Amazon Threat Intelligence links the compromise of axios, debug, chalk, and typo-crypto to a North Korean group tracked as SAPPHIRE SL…
MIT CSAIL: Interrupt Injection Bypasses Spectre v2 on Intel and AMD CPUs
MIT CSAIL researchers demonstrated that an unprivileged Linux program can inject precisely timed hardware interrupts to bypass Spectre…