A hacker group is poisoning open source code at an unprecedented scale

kept by eddie may 25

TeamPCP has automated its supply chain attacks with the Mini Shai-Hulud worm, breaching GitHub, OpenAI, and hundreds of firms.

The End Of Open Source - Gal Ratner
The article argues that open-source security now relies on accidental human vigilance rather than automated defenses, as AI agents increasingly exploit unmaintained projects and supply chains.
also on Socket, GitHub, #security, #open-source, #software-engineering
Google closes deal to acquire Wiz
Google completed its acquisition of cloud security startup Wiz after a year-long process, aiming to integrate its platform into Google Cloud.
also on wiz, #cybersecurity
Claude Security is now in public beta
Claude Security public beta lets Enterprise customers scan code for vulnerabilities and generate targeted patches using Opus 4.7, with integrations across partner platforms.
also on wiz, #security, #software-engineering
Scientists Find Way to Supercharge Dangerous Computer ‘Worms’ With A.I.
University of Toronto researchers built an AI-powered worm that autonomously spreads by tailoring exploits to each machine's known vulnerabilities.
also on #cybersecurity, #security, #open-source
AI is Breaking Two Vulnerability Cultures
AI is disrupting traditional vulnerability disclosure methods by making analysis of security patches cheap and effective, forcing shorter embargoes and revealing the inadequacy of both coordinated disclosure and 'bugs are bugs' cultures.
also on #cybersecurity, #security, #open-source