appsec.fyi · Sources

arstechnica.com

5 curated AppSec resources from arstechnica.com across 3 topics on appsec.fyi.

arstechnica.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-06-01.

Supply Chain 3 AI 1 Python 1
Date Added Resource Excerpt
2026-06-01 2026Dozens of Red Hat packages backdoored through its offical NPM channelSupply ChainWriteup detailing a supply-chain attack targeting Red Hat's official NPM channel. Threat actors compromised the `@redhat-cloud-services` namespace, publishing over 30 backdoored packages. These packages execute obfuscated payloads during `npm install`, stealing credentials like GitHub action secrets, npm tokens, Kubernetes, and Vault material. The malware then spreads by republishing compromised packages to other accounts, with infected systems encrypting and exfiltrating data via web requests or to compromised GitHub repositories.
2026-06-01 2026Millions of AI agents imperiled by critical vulnerability in open source packagePythonLibrary implementing ASGI for Python applications, Starlette, is vulnerable to CVE-2026-48710 (BadHost), allowing attackers to bypass authorization via a modified HTTP Host header. This critical vulnerability, trivially exploitable without proper firewalling, impacts FastAPI, vLLM, LiteLLM, and millions of AI agents relying on Starlette, potentially exposing sensitive data and third-party credentials.
2026-05-29 2026Fed up with vibe coders dev sneaks data-nuking prompt injection into their codeAILibrary update details a prompt injection vulnerability within the jqwik Java testing application for JUnit 5. The malicious instruction, disguised with ANSI escapes, directs AI coding agents to delete tests and code, posing a destructive risk to developers using vulnerable agents without warning or opt-out. Anthropic's Claude AI reportedly flagged this prompt injection.
2026-05-05 2026Widely used Daemon Tools disk app backdoored in monthlong supply-chain attackSupply ChainWriteup on the Daemon Tools supply-chain attack, detailing a monthlong compromise where malicious updates signed with official certificates infected versions 12.5.0.2421 through 12.5.0.2434. The malware, discovered by Kaspersky, exfiltrates system information and delivers follow-on payloads to select targets. This incident mirrors previous supply-chain attacks like CCleaner (2017), SolarWinds (2020), and 3CX (2023), highlighting the difficulty in defending against sophisticated, officially distributed compromises.
2026-04-27 2026Open source package with 1 million monthly downloads stole user credentialsSupply ChainLibrary **element-data** version 0.23.3 was compromised, stealing user credentials, cloud provider keys, API tokens, and SSH keys. A threat actor exploited a vulnerability in the developers' GitHub actions workflow to gain access to signing keys and sensitive information, allowing them to publish a malicious package to the Python Package Index and Docker image accounts. Users who installed the compromised version or ran the affected Docker image should assume their credentials may have been exposed.