eWeek

Clean GitHub Repo Attack Exposes AI Coding Agent Risk

Mozilla 0DIN’s Claude Code demo shows how clean GitHub repos can expose AI coding agents to prompt injection, reverse shells, and credential risk.
Rock Paper Shotgun

"Low-effort slop": The creators of the Godot engine behind Slay the Spire 2 are cracking down on "vibe-coding" and now require genAI disclosures

The Godot Foundation have announced a crackdown on genAI code, including mandatory disclosures, following a wave of ...

Malicious PyPI packages give hackers control of Telegram bot servers

A campaign active since last November has been targeting Python developers building Telegram bots with trojanized Pyrogram ...
OSTechNix

Linux Kernel 7.2 Hits 43 Million Lines: Verified with 4 Code Counters

Is Linux Kernel 7.2 really 43 million lines? We verified the count with wc, cloc, tokei, and scc tools and explain why the ...
InfoWorld

Microsoft MCP server gives AI assistants access to MSBuild logs

The Microsoft Binlog MCP Server enables AI-powered build failure diagnosis, property tracing, performance analysis, and build ...
Decrypt

Ornith Is the Open-Source Coding Model Built for Agents, Not Humans

Ornith 1.0 by DeepReinforce is meant for developers who want AI that finishes the job, not just autocompletes the next line.
SecurityWeek

Researchers Demo New Claude Code Attack Using Harmless-Looking Repositories to Hijack Developer Machines

Attackers can inject indirect prompts in normal-looking repositories to trick Claude Code into spawning a reverse shell.
InfoQ

Million PDFs: Building a Modern Document Infrastructure with Rust and Typst

Erik Steiger discusses the operational pain of legacy PDF generation in regulated banking and manufacturing. He explains how ...

Clean GitHub repo tricks AI coding agents into running malware

An agentic coding tool tasked with cloning and setting up a seemingly benign GitHub repository could execute a malicious ...
GitHub

A fast, lightweight text editor for Markdown, JSON, YAML, and TOML files. Built with Rust and egui for a native, responsive experience.

We've addressed this through code signing, build profile adjustments (disabled symbol stripping, speed optimization), and reporting to Microsoft's Security Intelligence portal. Ferrite does NOT access ...
cryptopolitan

Microsoft, Google patch flaws as Cordyceps spread across open-source repositories

Security researchers at Novee found over 300 exploitable CI/CD workflow chains across repositories belonging to Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation. The flaws ...