JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.

Part of the SD Times 100 2026 series. See the full SD Times 100 2026 list for every category and honoree. Application security has spent years maturing around a relatively stable assumption: a human ...

StegoAd Microsoft Edge extensions malware affected up to 2.6 million users after the company removed 119 add-ons that hid ...

Exclusive: Agentic coding startup Baz brings code reviews to the planning stage as it extends seed funding to $17M - ...

Attackers can inject indirect prompts in normal-looking repositories to trick Claude Code into spawning a reverse shell.

A attack using QR codes is known as "quishing," a combination of QR code and phishing. The danger isn't the QR code itself; ...

Beverage giants launch a major packaging update to give consumers direct access to global government food safety data.

Empty envelopes arriving in your mailbox could be tied to brushing scams in which sellers fake verified reviews using your ...

Eric Norman felt annoyed that every time he went to his go-to bar in the Castro, the Mix, he’d have his photo taken and ID ...

Brazilian startup Gabriel has residents paying to mount AI cameras outside their homes while police get the footage for free.

AIR says static scanning failed to detect a skill that redirected to a controlled domain and later altered its payload.

Veracode is a mature application security platform used by many enterprises to find, manage, and remediate software risk. Its ...