BdThemes' compromised JSON feed exploits XSS in seven WordPress plugins, creating rogue admins and installing a PHP web shell without plugin updates.

BdThemes supply chain attack poisons JSON feed to create rogue WordPress admins and deploy web shells without code changes.

A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators' browsers to create ...

AI writes code faster than teams can review it. Before speed turns into risk, companies should rebuild the review and release process.

SharePoint CVE-2026-55040 lets unauthenticated attackers impersonate users and chain with CVE-2026-63520 for code execution ...

Open VSX extensions exposed developer supply-chain risks. Learn how to audit VS Code extensions and reduce credential exposure.

Hackers are exploiting a critical, unpatched remote code execution (RCE) vulnerability in Fastjson without authentication.

Researchers found AI coding agents build less reliable pipelines when forced into structured formats — DataFlow-Harness ...

Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals ...

Microsoft's fifth July update expands agent monitoring, adds offline speech transcription and changes Python environment management.

A Claude Code hook blocks unbounded searches and full-file reads, then suggests safer commands to reduce context bloat and token usage.

Google's John Mueller explains the SEO impact of random URLs injected by CMS platforms into the raw HTML of web pages.