HalluSquatting Turns AI Package Hallucinations Into Botnet Traps
July 10, 2026
Tel Aviv University and Intuit documented HalluSquatting: AI coding tools hallucinate package names up to 100% of the time, which
Application Security
HalluSquatting Turns AI Package Hallucinations Into Botnet Traps
Tel Aviv University and Intuit documented HalluSquatting: AI coding tools hallucinate package names up to 100% of the time, which attackers preregister with malicious payloads.
Chrome 150 Patches Two Critical Use-After-Free Flaws in Ozone, Views
Google released Chrome 150.0.7871.114/.115 patching 27 vulnerabilities including two critical use-after-free bugs in Ozone and Views.
CMU Research: Copilot’s Safety Refusals Fail 100% in Workflow Mode
Carnegie Mellon researchers found GitHub Copilot refuses harmful prompts 99% of the time in chat but produced harmful code in all 816 workflow-mode tests across ...
Friendly Fire PoC Turns Claude Code and Codex Into Malware Launchers
AI Now Institute's Friendly Fire PoC shows Claude Code and Codex in security-audit mode will execute disguised malware when seeded with strings from a legitimate ...
Ill Bloom Flaw Drained $3.1M by Breaking Wallet Seed Randomness
Coinspect disclosed Ill Bloom, a weak entropy flaw in cryptocurrency wallet seed phrase generation that let attackers drain $3.1 million from affected wallets.
Injective Labs’ npm SDK Poisoned to Steal Crypto Wallet Credentials
Attackers compromised Injective Labs' repository and injected credential-stealing code into the authentic npm SDK packages used by DeFi blockchain developers.
OpenMandriva Linux Contributor Attempted Code Sabotage After Dispute
OpenMandriva Linux caught a contributor sabotage attempt before production, disclosing the insider supply chain attack after an internal community dispute.
CISA Adds ColdFusion, Langflow, Two Joomla CVEs to KEV
CISA added four actively exploited flaws to KEV on July 7, requiring federal agencies to patch ColdFusion, Langflow, and two Joomla extensions by July 10.
BonkDAO Loses $20M After Attacker Buys Quorum with ~$4M
An attacker spent approximately $4 million on BONK tokens to control 99.9% of votes in a low-turnout ballot and drain $20 million from BonkDAO's Solana ...
GitLost Prompt Injection Leaks Private GitHub Repos via Public Issues
Noma Security's GitLost technique tricks GitHub Agentic Workflows into leaking private repository contents via public issue comments, with no patch available.
Chrome 150 Patches Two Critical Use-After-Free Flaws in Ozone, Views
July 10, 2026
Google released Chrome 150.0.7871.114/.115 patching 27 vulnerabilities including two critical use-after-free bugs in Ozone and Views.
CMU Research: Copilot’s Safety Refusals Fail 100% in Workflow Mode
July 10, 2026
Carnegie Mellon researchers found GitHub Copilot refuses harmful prompts 99% of the time in chat but produced harmful code in
Friendly Fire PoC Turns Claude Code and Codex Into Malware Launchers
July 10, 2026
AI Now Institute’s Friendly Fire PoC shows Claude Code and Codex in security-audit mode will execute disguised malware when seeded
Ill Bloom Flaw Drained $3.1M by Breaking Wallet Seed Randomness
July 10, 2026
Coinspect disclosed Ill Bloom, a weak entropy flaw in cryptocurrency wallet seed phrase generation that let attackers drain $3.1 million
Injective Labs’ npm SDK Poisoned to Steal Crypto Wallet Credentials
July 10, 2026
Attackers compromised Injective Labs’ repository and injected credential-stealing code into the authentic npm SDK packages used by DeFi blockchain developers.
OpenMandriva Linux Contributor Attempted Code Sabotage After Dispute
July 10, 2026
OpenMandriva Linux caught a contributor sabotage attempt before production, disclosing the insider supply chain attack after an internal community dispute.
CISA Adds ColdFusion, Langflow, Two Joomla CVEs to KEV
July 8, 2026
CISA added four actively exploited flaws to KEV on July 7, requiring federal agencies to patch ColdFusion, Langflow, and two
BonkDAO Loses $20M After Attacker Buys Quorum with ~$4M
July 8, 2026
An attacker spent approximately $4 million on BONK tokens to control 99.9% of votes in a low-turnout ballot and drain
GitLost Prompt Injection Leaks Private GitHub Repos via Public Issues
July 7, 2026
Noma Security’s GitLost technique tricks GitHub Agentic Workflows into leaking private repository contents via public issue comments, with no patch
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.