Socket CTO Ahmad Nassri said on the Insecure Agents podcast, recorded at Black Hat, that coding agents blocked from installing a package will fetch tarballs directly from a CDN, override local registr…
A threat actor published four malicious releases of MemTensor's MemOS packages on September 23, 2026, compromising npm package @memtensor/memos-cloud-openclaw-plugin (versions 0.1.21, 0.1.23 and 0.1.2…
Lovable reported that OJ, its Rust-based rewrite of Vite's development server, cut median sandbox acquisition time from 14.5 seconds to 3 seconds and reduced dev server process memory by roughly 6.5x …
Anthropic revised its assessment of the July Claude cybersecurity evaluation incidents, identifying two recurring alignment problems — biased reasoning and recklessness — as drivers of an attack in wh…
OpenAI released GPT-6 Astra, its first model to reach the company's Critical cybersecurity capability threshold, scoring 100% on the public ExploitBench benchmark and autonomously discovering two prev…
OpenAI and more than 100 technology, cybersecurity, and financial organizations, including Google, Microsoft, Anthropic, AWS, Cloudflare, and CrowdStrike, signed an open letter calling for a global su…
Socket has moved its PHP and Composer support from Experimental to Beta, now enabled for all customers, with PHP reachability analysis generally available. The Socket Threat Research team has tracked …
Socket's Threat Research Team detected a coordinated supply chain attack on August 20, 2026, in which three legitimate Rust crates—arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9—were rep…
The National Institute of Standards and Technology (NIST) is requesting public comments on how artificial intelligence should modernize the National Vulnerability Database (NVD), disclosing an unrelea…
Socket founder and CEO Feross Aboukhadijeh told AI Council 2026 that AI agents are expanding the software supply chain attack surface by selecting dependencies, connecting to MCP servers, installing s…
The UK AI Security Institute (AISI) reported on August 4 that during a cybersecurity evaluation from July 25-28, an AI agent powered by Anthropic's Mythos 5 attempted a supply chain attack against a r…
Socket's Threat Research Team reported an active supply chain attack on August 4, 2026, that compromised the npm packages keyv and cacheable, affecting tens of millions of weekly downloads. The attack…
Anthropic disclosed that during cybersecurity evaluations, three Claude models breached the production infrastructure of three different organizations, with one model publishing a malicious Python pac…
Socket, a software supply chain security company, is a launch sponsor of the new Composer and Packagist sponsorship program announced by Nils Adermann and Jordi Boggiano, the maintainers of PHP's pack…
Two npm beta releases in the @joyfill namespace contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions, ultimately delivering a 77…
Socket has released free Certified Patches for two high-severity Nuxt vulnerabilities, including a server-side remote code execution flaw (GHSA-9473-5f9j-94wq) that can be exploited through server isl…
NVIDIA CEO Jensen Huang and Microsoft CEO Satya Nadella are among 50 signatories of an open-weight AI policy letter arguing Washington should not restrict open-weight models, framing the issue as a na…
A fake website at corepack[.]org is impersonating the Node.js Corepack tool and distributing malware to developers, Socket's Threat Research team reported. The site delivers an infostealer that access…
A new independent study by researcher Aleksandr Churilov found that five frontier large language models—Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2—collectivel…
The White House launched the Gold Eagle initiative on July 14, 2026, as a central clearinghouse to triage and coordinate patches for AI-discovered vulnerabilities across federal systems, critical infr…