Composer's allow-plugins Is a Code Execution Boundary
Composer's allow-plugins Is a Code Execution Boundary A PHP dependency installation can run third-party code before the application starts. Composer plugins ...
Never miss the headlines that matter
Get the week's top stories from 100+ sources in your inbox. Free, no spam.
Security Articles
Updated 3 min ago · 91 articles
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
Certain configurations of Alpine are affected. Other distros may be as well.
OpenAI launches GPT-6 Cyber, an Astra model built to keep vulnerability research in scope
OpenAI Group PBC today released GPT-6 Cyber, a version of its GPT-6 Astra model trained specifically for authorized vulnerability research. The new model goe...
Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts
Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks, using two different phishing-as-a-service pla...
What We Missed: Knicks Phishing Test Goes Out of Bounds
In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from an ill-conceived phishing simulation to a h...
MS Paint Remote Code Execution Vulnerability
Article URL: https://www.cve.org/CVERecord?id=CVE-2026-83844 Comments URL: https://news.ycombinator.com/item?id=50384233 Points: 448 # Comments: 172
Ad
Mercado Bitcoin Said Its Hack Was Contained, But Blockchain Data Tells a Different Story
Fresh forensic analysis traces $48.6 million across 11 blockchains and finds thousands of customer deposit addresses drained hours after the Brazilian exchan...
Chainalysis Breach Exposes Passwords and Tokens for All Users, Forcing Service Shutdowns
Blockchain analytics firm Chainalysis has disclosed that hackers accessed password hashes and active authentication tokens for all users of its platform, pro...
OpenAI released a new cybersecurity model. Is that enough?
OpenAI's newest cybersecurity model comes out as AI labs face scrutiny of their work to protect digital infrastructure.
Binance, Deribit revoke SignalPlus API keys after fake Teams invite attack
SignalPlus said attackers compromised an engineer’s computer in a breach that resulted in losses of less than $82,000, which the crypto trading platform pled...
SourceHut disabled registration bypass | CVE-2026-121728
Comments
Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction
Cybersecurity researchers have disclosed details of a now-patched vulnerability that could be exploited to bypass Lockdown Mode protections in OpenAI ChatGPT...
Loading...
All 91 articles loaded