Weekly ThreatsDay recap: old bugs, fake tools, shady payload tricks, AI mishaps, and the usual reminder that the internet is ...

AGENTS.md 是一个放置在项目根目录的纯 Markdown 文件，专门用于指导 AI 编码 Agent 的行为。 最近在用 Cursor 和 Codex 写代码的时候，我越来越发现一个问题：每次新开会话，AI 都要重新问一遍项目结构、用什么包管理器、代码该放哪层。久而久之就觉得烦。 AGENTS.md ...

A VS Code vulnerability in GitHub.dev lets attackers steal full GitHub OAuth tokens via a single malicious link, exposing all private repositories.

Days after IBM and Red Hat announced a master security plan for open-source software, Red Hat suffers a major breach of its ...

Fake Claude Code installer malware used Google Ads to place spoofed AI tool pages above real documentation since March 2026.

A sneaky IAB operation uses a malicious traffic distribution system (TDS) to redirect visitors of trusted websites to ones ...

Hackers published 96 malicious package versions, injected with a credential-stealing worm similar to Mini Shai-Hulud. On Monday, hackers hit Red Hat’s NPM repository in a new supply chain attack, ...

The bill has drawn much criticism from tech companies and civil-liberties groups that warn it could compromise cybersecurity ...

A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft, and ...