Cybersecurity

The Agent Attack Surface: Why Your Governance Infrastructure Is Your Defense

Three months ago, OpenClaw agents hosted 12% malicious skills in ClawHub. Last week, Hugging Face di…

My Summer of Sleuthing: 373 Merged PRs and the Bugs That Taught Me Everything

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry. "The best deb…

GHSA-86CX-WWF4-PHQ4: GHSA-86cx-wwf4-phq4: Path Prefix Confusion Authorization Bypass in OpenList

GHSA-86cx-wwf4-phq4: Path Prefix Confusion Authorization Bypass in OpenList Vulnerability ID: GHS…

Empty memory isn’t missing data. It’s a permission hole.

Definition: In multi-agent systems, an empty memory recall often means this agent is not allowed to …

Malicious sites use JavaScript to build malware in browser memory

A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious …

12 things to check before you ship your vibe-coded app

Getting an app to work has stopped being the hard part. You describe what you want, Lovable or Bolt …

A Typosquat Package Almost Got My Keys: Dissecting the Attack Safely

A recruiter DM led to a "take-home" repo. Standard stuff, or so it looked. I cloned it, opened packa…

How to Change a PostgreSQL User Password (Supabase)

The one-line answer ALTER ROLE alice WITH PASSWORD 'new_password'; That is the SQL. The r…

🛡️ Threat Intel Diario — 25/07/2026

🤖 Auto-generated daily threat intelligence digest — July 25, 2026 🚨 Alerta de Seguridad Cibernética…

Where does Secure by Design End? A 3D/4D Model

I’ve been thinking about a surprisingly intricate question: Where does Secure by Design ac…

CVE-2026-16584: CVE-2026-16584: Security Policy Bypass in AWS API MCP Server via Startup Initialization Failure

CVE-2026-16584: Security Policy Bypass in AWS API MCP Server via Startup Initialization Failure V…

ShinyHunters data leaks fuel $2,000 sextortion email scam

Threat actors are using email addresses exposed in data breaches leaked by the ShinyHunters extortio…