Developers who pulled packages from Red Hat’s @redhat-cloud-services npm namespace over the weekend got a secret-stealing worm instead. Security researchers from several cybersecurity outlets are warning of a new supply chain attack compromising over 30 Red Hat Cloud Services-related npm packages to steal credentials, authentication tokens, and other secrets from developer environments. The campaign, which…
Tag: developers
AI, Apps, Data Breaches, Endpoint, Global Security News, malware, Network Security, Risk Management
Fake Claude Code Installers Deliver Credential-Stealing Malware
Developers searching for Claude Code installation instructions could be walking into a sophisticated malware campaign that disguises itself as legitimate AI tooling documentation. Researchers found dozens of fake Claude Code and developer platform sites designed to steal credentials, API keys, and cryptocurrency. “The attack chain runs on the same unchecked trust that makes AI developer…
AI, Apps, Global Security News, privacy
WWDC: What can developers expect?
Apple will open the doors to developers at its Worldwide Developer Conference (WWDC) next week. Beyond a big push on AI and new OSes focused on stability and performance, what should developers expect? Mostly it’s about new APIs, Foundation Models, and App Intents; here’s what I’ve been able to figure out so far. Foundation Models Apple has…
AI, Global Security News
New threat actor JINX-0164 targets crypto firms with macOS malware
The campaign, active since mid-2025, uses recruitment-themed social engineering to lure developers into downloading a Python-based infostealer and remote access trojan named AUDIOFIX.
Global Security News, malware
New Threat Actor Jinx-0164 Targets Crypto Developers on macOS
New actor Jinx-0164 hit crypto developers with fake recruiter lures and macOS malware
Global Security News, AI, Risk Management, Apps
Developers on H-1B face a tighter job market as AI shifts hiring priorities
For years, software developers on H-1B visas benefited from steady demand among US technology employers. That market is becoming more selective as companies redirect spending toward AI and rely more heavily on coding assistants. Recent layoffs at companies including Meta and Amazon have added to the uncertainty, with engineering and software roles affected even as…
AI, Global Security News
OWASP launches FinBot to help developers secure AI agents
OWASP’s FinBot gives developers hands-on training to secure AI agents.
Global Security News
CrowdStrike, Google Take Down Glassworm Botnet
Operators of the malicious Glassworm botnet have been targeting software developers since at least early 2025
AI, Global Security News, Network Security
Glassworm botnet disrupted after resilient C2 infrastructure takedown
The Glassworm botnet targeting developers in software supply-chain attacks has been disrupted after researchers took down its resilient command-and-control infrastructure relying on Solana blockchain transactions and the BitTorrent DHT network. […]
AI, Global Security News, malware, Network Security, Risk Management, Russia
How cybersecurity firms took down Glassworm botnet in one shot
Glassworm infected developers through poisoned tools and packages until a coordinated takedown killed all four of its C2 channels at once. On May 26, 2026, at 14:00 UTC, CrowdStrike Counter Adversary Operations team, working with Google and the Shadowserver Foundation, killed all four command-and-control channels of the Glassworm botnet at the same time. The timing…
Global Security News, malware
Trojanized Gemini and Claude Installers Target Developers Via SEO Poisoning
Cybercriminals are using SEO poisoning and fake Gemini and Claude installer sites to infect developers with fileless malware and steal data.
AI, Global Security News, malware
Laravel Lang packages hijacked to deploy credential-stealing malware
A supply chain attack targeting the Laravel Lang localization packages has exposed developers to a sophisticated credential-stealing malware campaign after attackers abused GitHub version tags to distribute malicious code through Composer packages. […]
AI, Data Breaches, Exploits, Global Security News, Risk Management
Meet Rampart and Clarity, Microsoft’s new red team combo AI agents
On Wednesday, Microsoft released two new red teaming tools—Rampart and Clarity—,meant to help developers design more secure agentic software and assist incident responders in the face of ongoing breaches. Rampart is built on top of PyRIT, an existing open automation framework Microsoft developed for red teaming generative AI systems. But while PyRIT scans already-built systems…
AI, Global Security News, Risk Management
Microsoft Open-Sources RAMPART and Clarity to Secure AI Agents During Development
Microsoft has unveiled two new open-source tools called RAMPART and Clarity to assist developers in better testing the security of artificial intelligence (AI) agents. RAMPART, short for Risk Assessment and Measurement Platform for Agentic Red Teaming, functions as a Pytest-native safety and security testing framework for writing and running safety and security tests for AI…
AI, Global Security News, Risk Management
Coming Bright Up: Apple’s AI moment looms
Apple has confirmed this year’s Worldwide Developers Conference (WWDC) will take place June 8-12. The show begins with a keynote speech likely to be Tim Cook’s final public appearance as Apple’s CEO. His successor, John Ternus, will also be in the spotlight, but perhaps not quite as much as Apple’s promised smart Siri successor. Getting AI right is incredibly…
AI, Cybersecurity, Data Breaches, Exploits, Global Security News, malware, Risk Management
Shai-Hulud worm copycats emerge after source code leak
Shai-Hulud worm copycats are already attacking NPM developers after its source code leaked, enabling fast supply chain exploitation. The first copycats of the Shai-Hulud worm have already started showing up online, only a few days after the malware’s source code was dumped on GitHub. Researchers had warned this would happen almost immediately, and they were…
AI, Global Security News
Shai-Hulud Worm Clones Spread After Code Release
The release of Shai-Hulud source code spells trouble for software developers as researchers worry the self-replicating worm could scale.
AI, Exploits, Global Security News
The Boring Stuff is Dangerous Now
AI agents capable of discovering and exploiting obscure vulnerabilities are emerging alongside developers producing vast amounts of potentially flawed AI-generated code, forcing defenders to adapt accordingly.
AI, Global Security News, malware
Fake Claude Code Installer Targets Developers With Browser Credential Stealer
Researchers at Ontinue have discovered an undocumented malware campaign targeting developers with fake Claude Code installers to steal browser passwords and cookies.
AI, Apps, Global Security News, malware, Network Security
Fake Claude Code takes the IElevator to your browser secrets
Developers looking for Anthropic’s increasingly popular Claude Code tool are now being lured into downloading malware. According to researchers at Ontinue, attackers are abusing a fake Claude Code installer to deliver a previously undocumented PowerShell payload. The malware is designed to evade detection, recover browser encryption material, and steal sensitive data from developer systems. “Developers…
AI, Apps, Endpoint, Global Security News, Risk Management
AI Is Reshaping Software Supply Chain Risk
Artificial intelligence is rapidly transforming how developers build software, but security controls are struggling to keep pace. According to Willem Delbare, co-founder and CEO of Aikido Security, AI-assisted development is fundamentally changing the software supply chain threat model by increasing automation around code generation, dependency selection, and tool installation. “As of 2025, 84% of developers…
AI, Global Security News, Risk Management
Linux developers weigh emergency “killswitch” for vulnerable kernel functions
Linux kernel developers are reviewing a proposal for an emergency risk mitigation mechanism (“Killswitch”) that would allow administrators to disable vulnerable kernel functions at runtime. The proposal, submitted by Linux kernel developer/maintainer Sasha Levin, arrives in the wake of the public disclosure of two privilege escalation vulnerabilities affecting the Linux kernel. What prompted the proposal…
AI, Global Security News, malware, Network Security, Risk Management
Quasar Linux RAT (QLNX): A Fileless Linux Implant Built for Stealth and Persistence
Researchers uncovered QLNX, a Linux RAT targeting developers to steal credentials, log keystrokes, monitor systems, and enable remote access. Security researchers discovered a previously undocumented Linux malware called Quasar Linux RAT (QLNX) that targets developers and DevOps environments. The malicious code can steal credentials, log keystrokes, manipulate files, monitor clipboard activity, and create network tunnels…
AI, Global Security News, Network Security
Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise
A previously undocumented Linux implant codenamed Quasar Linux RAT (QLNX) is targeting developers’ systems to establish a silent foothold as well as facilitate a broad range of post-compromise functionality, such as credential harvesting, keylogging, file manipulation, clipboard monitoring, and network tunneling. “QLNX targets developers and DevOps credentials across the software supply chain,”
AI, Global Security News
Google is turning Android Studio into a policy watchdog
Google has expanded Play Policy Insights in Android Studio to help developers catch policy issues while coding, including warnings for common problems such as missing login credentials. Later this year, developers who connect their Play developer account directly to Android Studio will receive tailored insights. By leveraging SDK Index, a searchable list of Android SDKs…
AI, Global Security News
One keypress is all it takes to compromise four AI coding tools
Developers clone unfamiliar repositories all the time. Open-source projects, work from teammates, sample code from a tutorial, a library someone recommended on a forum. The convention is old and reasonable: you look at what’s inside before you run it. AI coding assistants that work from the command line have inherited that convention, and a new…
AI, Apps, Global Security News
Node.js 26 ships with Temporal API enabled by default
Developers managing JavaScript runtimes have a new major version to evaluate. Node.js 26.0.0 brings the long-awaited Temporal API to the platform alongside an updated V8 engine, a refreshed HTTP client, and several long-flagged removals that will require code changes in some applications. Temporal API ready for production code Temporal, a date and time API designed…
Global Security News
New stealthy Quasar Linux malware targets software developers
A previously undocumented Linux implant named Quasar Linux (QLNX) is targeting developers’ systems with a mix of rootkit, backdoor, and credential-stealing capabilities. […]
AI, Global Security News, Risk Management
Google, Microsoft and xAI Agree to Share Early AI Models with U.S.
The agreement calls for AI developers to share models with reduced or removed safeguards to evaluate national security-related capabilities and risks.
Global Security News
Can your coding style predict whether your code is vulnerable?
Developers leave fingerprints in the code they write. Naming choices, indentation patterns, preferred APIs, and the way someone structures a loop or handles a pointer all carry traces of individual habit. Researchers have used these stylistic signals for years to identify the authors of anonymous code samples, sometimes with surprising accuracy. A team at the…
AI, Apps, Global Security News, Network Security, privacy
Open-source privacy proxy masks PII before prompts reach external AI services
Enterprise developers routinely send prompts to external large language models that contain customer emails, support transcripts, and other identifying information, often without a sanitization layer between the application and the API. Dataiku has released Kiji Privacy Proxy, an open-source local gateway that detects and masks personally identifiable information before requests leave the network. The tool…
AI, Global Security News
Warp open sources its AI terminal client
Warp, the AI-centric terminal used by close to a million developers, has released the source code for its client on GitHub under the AGPL license, with OpenAI signed on as the founding sponsor of the repository. An agent-first contribution model Warp is steering contributions through Oz, its cloud agent orchestration platform. Agents handle the bulk…
AI, Global Security News, Risk Management
Xiaomi releases MIT‑licensed MiMo models for long‑running AI agents
Xiaomi has released and open-sourced MiMo-V2.5 and MiMo-V2.5-Pro under the MIT License, giving developers another potentially lower-cost option for building AI agents that can run longer tasks such as coding and workflow automation. Both models support a 1-million-token context window, the company said. MiMo-V2.5-Pro is designed for complex agent and coding tasks, while MiMo-V2.5 is…
Global Security News, privacy
A study of 1,000 Android apps finds a privacy policy logging gap
Android developers write log statements for the same reasons they always have: debugging crashes, tracing performance issues, and understanding how features behave in production. Legal and privacy teams, working from templates and regulatory checklists, draft policies describing what the app collects from users. These two workflows rarely intersect inside the same company. A new study…
AI, Global Security News
Where AI in CI/CD is working for engineering teams
Developers have folded AI into daily coding work. Still, the same tools remain largely absent from the systems that validate and ship software. New research from JetBrains points to a widening gap between how engineers write code on their own machines and what runs inside continuous integration and delivery pipelines. Daily coding use climbs past…
AI, Apps, Endpoint, Global Security News, malware, Network Security, Risk Management
Malicious pgserve, automagik developer tools found in npm registry
Application developers are being warned that malicious versions of pgserve, an embedded PostgreSQL server for application development, and automagik, an AI coding tool, have been dropped into the npm JavaScript registry, where they could poison developers’ computers. Downloading and using these versions will lead to the theft of data, tokens, SSH keys, credentials, including those…
AI, Apps, Exploits, Global Security News
Microsoft issues out-of-band patch for critical security flaw in update to ASP.NET Core
Developers are advised to check their applications after Microsoft revealed that last week’s ASP.NET Core update inadvertently introduced a serious security flaw into the web framework’s Data Protection Library. Microsoft describes the issue as a “regression,” coding jargon for an update that breaks something that was previously working correctly. In this case, what was introduced…
Global Security News, malware
DPRK Fake Job Scams Self-Propagate in ‘Contagious Interview’
A compromised developer’s repository serves as a worm-like infection vector to spread remote access Trojans (RATs) and other malware.
AI, Global Security News
OpenAI updates Agents SDK, adds sandbox for safer code execution
OpenAI’s updated Agents SDK helps developers build agents that inspect files, run commands, edit code, and handle tasks within controlled sandbox environments. The update provides standardized infrastructure for OpenAI models, a model-native harness that lets agents work with files and tools on a computer, and native sandbox execution for running tasks safely. The new harness…
AI, Apps, Global Security News, Risk Management
What the EU AI Act requires for AI agent logging
The EU AI Act is 144 pages long. The logging requirements that matter for AI agent developers sit across four articles that keep referencing each other. Here’s what they say, when the deadlines hit, and where the gaps are. Your agent is probably high-risk The Act doesn’t mention “AI agents” by name. What matters is…
AI, Apps, Global Security News, Risk Management
Curity looks to reinvent IAM with runtime authorization for AI agents
In 2026, enterprise developers are building and deploying the first generation of powerful, increasingly autonomous AI agents at incredible speed. Now comes the hard part: working out how to secure them. Vendors in the space are facing multiple challenges. To begin with, traditional identity and access management (IAM) tools were never designed to secure anything…
AI, Apps, Global Security News, Risk Management
Curity looks to reinvent IAM with runtime authorization for AI agents
In 2026, enterprise developers are building and deploying the first generation of powerful, increasingly autonomous AI agents at incredible speed. Now comes the hard part: working out how to secure them. Vendors in the space are facing multiple challenges. To begin with, traditional identity and access management (IAM) tools were never designed to secure anything…
AI, Global Security News
Microsoft rolls out fast-track to reinstate Windows hardware dev accounts
Microsoft has rolled out a fast-track process to help developers regain access to accounts recently suspended from its Windows Hardware Program, following widespread complaints that they were locked out without warning. […]
Global Security News, malware
OpenSSF Flags Malware Campaign on Slack Posing as Linux Foundation Figures
OpenSSF warns hackers impersonate Linux Foundation leaders on Slack, tricking developers into installing malware that can compromise entire systems.
AI, Global Security News, Risk Management
Why GitHub Developers Are Targeted by Token Giveaway Scams
GitHub developers face rising giveaway scams. Verify repos, links, and maintainers before acting. Avoid rushed clicks, fake rewards, and risky wallet actions.
AI, Cybersecurity, Exploits, Global Security News
Vim and GNU Emacs: Claude Code helpfully found zero-day exploits for both
Developers can spend days using fuzzing tools to find security weaknesses in code. Alternatively, they can simply ask an LLM to do the job for them in seconds. The catch: LLMs are evolving so rapidly that this convenience might come with hidden dangers. The latest example is from researcher Hung Nguyen from AI red teaming…
AI, Global Security News
Android Developer Verification Rollout Begins Ahead of September Enforcement
Google on Monday said it’s officially rolling out Android developer verification to all developers to combat the problem of bad actors distributing harmful apps while “hiding behind anonymity.” The development comes ahead of a planned verification mandate that goes into effect in Brazil, Indonesia, Singapore, and Thailand this September, before it expands globally next year.…
AI, Global Security News, malware, Risk Management
Hackers Poison Axios npm Package with 100 Million Weekly Downloads
Axios npm Package compromised in a supply chain attack, exposing developers to malware, data theft, and full system takeover risks worldwide.
AI, Global Security News, malware
Fake VS Code alerts on GitHub spread malware to developers
A large-scale campaign is targeting developers on GitHub with fake Visual Studio Code (VS Code) security alerts posted in the Discussions section of various projects, to trick users into downloading malware. […]
AI, Global Security News
Fake OpenClaw Token Giveaway Targets GitHub Devs with Wallet-Draining Scam
OX Security reveals a new phishing campaign targeting GitHub developers. Scammers use fake OpenClaw token giveaways to trick users into connecting and draining their crypto wallets
AI, Global Security News, malware
GitHub-hosted malware campaign uses split payload to evade detection
A large-scale malware delivery campaign has been targeting developers, gamers, and general users through fake tools hosted on GitHub, Netskope researchers have warned. These “lures” are highly polished and appear legitimate, occasionally mimicking real projects, thus making them difficult to distinguish from safe software. A dual-component trojan is delivered Netskope threat researchers first discovered a…
AI, Data Breaches, Exploits, Global Security News, malware, Risk Management
44 Aqua Security repositories defaced after Trivy supply chain breach
Malicious Trivy images on Docker Hub spread infostealer malware, exposing developers after a supply chain attack. Researchers found malicious Trivy images on Docker Hub linked to a supply chain attack. Versions 0.69.4–0.69.6, now removed, contained TeamPCP infostealer code. Suspicious tags were pushed without matching GitHub releases, increasing the risk to developers using compromised container images.…
AI, Apps, Global Security News
We Found Eight Attack Vectors Inside AWS Bedrock. Here’s What Attackers Can Do with Them
AWS Bedrock is Amazon’s platform for building AI-powered applications. It gives developers access to foundation models and the tools to connect those models directly to enterprise data and systems. That connectivity is what makes it powerful – but it’s also what makes Bedrock a target. When an AI agent can query your Salesforce instance, trigger…
Global Security News
NICKEL ALLEY strategy: Fake it ‘til you make it
Victimizing software developers via fake companies, jobs, and code repositories to steal cryptocurrency Categories: Threat Research Tags: NICKEL ALLEY, Contagious Interview, North Korea, clickfix
AI, Global Security News
Google slows Android sideloading to trip up scammers
Google’s advanced flow for Android changes how apps from unverified developers are installed, adding steps to reduce scam-driven sideloading. The feature is aimed at experienced users and allows sideloading through a controlled, one-time setup. It addresses scam scenarios where attackers pressure individuals to install malicious software. In these cases, scammers often stay on the phone…
AI, Exploits, Global Security News, malware, Risk Management
Are you ready for shape-shifting apps?
With a 60% surge in App Store submissions as developers embrace vibe coding and AI-assisted development tools, Apple’s App Store team has identified an emerging security challenge: what happens when an app you download later evolves into something fundamentally different — without Apple having a chance to review those changes. Vibe coding the new attack surface…
AI, Global Security News, Risk Management
Hidden instructions in README files can make AI agents leak data
Developers rely on AI coding agents to set up projects, install dependencies, and run commands by following instructions in repository README files, which provide setup guidance for software projects. New research identifies a security risk when attackers hide malicious instructions in those documents. A semantic injection attack, where injections are embedded in an installation file,…
AI, Apps, Global Security News, Risk Management
ENISA advisory examines package manager security risks
Developers install external libraries with a single command, and that step can introduce more code than expected into a project environment. Dependency resolution inside package managers extends software supply chains across large collections of external components. ENISA’s Technical Advisory for Secure Use of Package Managers, released in March 2026, examines how this development practice expands…
AI, Apps, Endpoint, Exploits, Global Security News, Risk Management
The CISO’s Dilemma: How To Scale AI Securely
Your board wants AI. Your developers are building with it. Your budget committee is asking for an ROI timeline. But as CISO, you’re the one who has to answer when the inevitable question comes up: “How do we know this is secure?” If you’re like most security leaders, you’re caught between two impossible positions. Say…
AI, Apps, Exploits, Global Security News, Risk Management
ENISA Technical Advisory on Secure Package Managers: Essential DevSecOps Guidance
ENISA’s first Technical Advisory on Secure Package Managers helps developers safely use third-party packages. ENISA has released its first Technical Advisory on Package Managers, focusing on how developers can safely consume third-party packages. The document (March 2026, v1.1) follows public feedback incorporating 15 contributions from stakeholders, experts, and the open-source community. “This document focuses on…
AI, Apps, Data Breaches, Endpoint, Global Security News, malware, Network Security, Risk Management
Fake OpenClaw npm Package Installs GhostClaw Malware
A malicious npm package is targeting developers by posing as a legitimate command-line tool while secretly deploying an infostealer and a remote access trojan (RAT). The package, @openclaw-ai/openclawai, masquerades as an OpenClaw Installer utility but instead initiates a multi-stage malware operation. Once executed, it attempts to steal credentials, cryptocurrency wallets, SSH keys, browser data, and…
AI, Global Security News
Datadog MCP server delivers live observability to AI agents and IDEs
Datadog has announced the general availability of its MCP Server. For developers embedding AI agents into development and operational workflows, the Datadog MCP Server provides access to live observability data, enabling teams to debug with their preferred AI coding agents or integrated development environments (IDEs), use real-time telemetry, and take action within established security and…
AI, Compliance, Global Security News, Government & Policy
UK lawmakers back licensing‑first approach, adding pressure to global AI copyright standards
AI developers must obtain licenses for copyrighted material before using it to train models, a committee of the House of Lords, the UK Parliament’s upper chamber, said Thursday. The committee called the approach “licensing-first,” meaning no training on protected works without prior permission and payment, regardless of how the material is sourced. The committee has…
AI, Global Security News
March 2026 Patch Tuesday forecast: Is AI security an oxymoron?
Developers and analysts are using more AI tools to produce code and to test both the performance and security of the finished products. They are also embedding AI functionality in their products directly. But just how secure are these AI tools and routines themselves? Recent reports show they suffer from vulnerabilities just like any other…
AI, Global Security News
Google speeds up Chrome updates with new security-focused release cycle
The Chrome browser is moving to a two-week release cycle, a change intended to give developers and users faster access to new features, performance improvements and bug fixes. The new schedule begins with the stable release of Chrome 153 on September 8, 2026, followed by new beta and stable releases every two weeks. The change…
AI, Global Security News
Fake Next.js job interview tests backdoor developer’s devices
The Microsoft Defender team has discovered a coordinated campaign targeting software developers through malicious repositories posing as legitimate Next.js projects and technical assessment materials, including recruiting coding tests. […]
Global Security News
Malicious NuGet Package Targets Stripe Developers
Malicious NuGet package mimicking Stripe’s library targeted developers
Global Security News
Anthropic brings Claude Code to mobile devices
Anthropic has introduced a new Claude Code feature called Remote Control, allowing developers to continue a local coding session from a phone, tablet, or any web browser. The feature is rolling out as a research preview to Max users. This is another in a series of additions the company has introduced recently, following Claude Opus…
AI, Endpoint, Exploits, Global Security News, malware, Network Security, Risk Management
Microsoft warns of job‑themed repo lures targeting developers with multi‑stage backdoors
Microsoft says it has uncovered a coordinated campaign targeting software developers through malicious repositories posing as legitimate Next.js projects and technical assessments. The campaign employs carefully crafted lures to blend into routine workflows, such as cloning repositories, opening projects, and running builds, thereby allowing the malicious code to execute undetected. Telemetry collected during an incident…
AI, Global Security News
Apple blocks 18+ app downloads in select markets
Apple has introduced expanded age assurance tools to help developers comply with regulations taking effect in Brazil, Australia, Singapore, Utah, and Louisiana. The updates, available in beta, expand the Declared Age Range API and related App Store systems. Age-based download restriction As of February 24, 2026, Apple began blocking users from downloading apps rated 18+…
AI, Global Security News, malware
Self-spreading npm malware targets developers in new supply chain attack
Security researchers have uncovered another supply chain attack targeting developers: 19 typosquatting npm packages published on npmjs.com that steal credentials, infect projects, and propagate themselves across developer environments. The operation, dubbed “SANDWORM_MODE,” represents a (still) rare example of worm-like malware designed to spread through software supply chains rather than traditional end-user systems. New npm worm…
AI, Apps, china, Compliance, Exploits, Global Security News, Risk Management
Anthropic alleges large-scale distillation campaigns targeting Claude
Anthropic has accused three Chinese AI developers of running large-scale campaigns to illicitly extract capabilities from its Claude model to improve their own systems. The company claims DeepSeek, Moonshot, and MiniMax used a distillation technique, where a less capable model is trained on the outputs of a more advanced one. More than 16 million interactions…
AI, Global Security News
Why the shift left dream has become a nightmare for security and developers
The “shift left” approach has increased pressure on developers, as speed demands override security checks in modern CI pipelines. Qualys explains how analyzing 34,000 public container images revealed 7.3% were malicious and why security must be enforced at the infrastructure layer by default. […]
AI, Apps, Compliance, Global Security News, Risk Management
The new paradigm for raising up secure software engineers
CISOs were already struggling to help developers keep up with secure code principles at the speed of DevOps. Now, with AI-assisted development reshaping how code gets written and shipped, the challenge is rapidly intensifying. Whereas only about 14% of enterprise software engineers regularly used AI coding assistants two years ago, that number is on its…
AI, Global Security News
Move Over, Super Bowl: AI Giants Turn China’s Lunar New Year Into a Giveaway Blitz
AI developers in are offering free tea, free use of cars and even robots in promotions aimed at locking in users.
Global Security News, privacy
Android 17 beta brings privacy, security, and performance changes
Google has released the first beta of Android 17, giving developers an early view of changes to core app behavior, platform tooling, performance, media handling, and connectivity. The company plans to move quickly from this beta toward the Platform Stability milestone, targeted for March, where final APIs and behavior definitions for apps will be delivered.…
AI, Apps, Exploits, Global Security News, Network Security
Researchers unearth 30-year-old vulnerability in libpng library
Developers have resolved a legacy flaw in the widely used libpng open-source library that existed since the software was released nearly 30 years ago. The heap buffer overflow in libpng would cause applications on unpatched systems to crash when presented with maliciously crafted PNG graphic images. In worse case scenarios, the CVE-2026-25646 vulnerability could be…
AI, Apps, Global Security News, Government & Policy, Risk Management, Venture
JumpCloud: Most businesses aren’t truly ready for AI
As developers begin using Claude and Codex to help create Mac, iPhone, and iPad apps in Xcode, spare a moment to consider a recent JumpCloud survey that shows most businesses aren’t really ready for AI — though many think they might be.
Among the highlights from the survey:
- 40% of IT leaders self-assess as mature in their AI practices, yet only 22% meet the rigorous objective standards for leading AI readiness.
- 90% of leaders see productivity gains from AI, but 74% remain concerned about security risks, specifically around unauthorized data access and AI-generated phishing.
- 61% of organizations report the use of unsanctioned AI tools, creating significant visibility and governance gaps.
- 85% of IT leaders agree that secure identity and access management (IAM) is critical for scaling AI safely. (Note that JumpCloud calls itself an AI-powered IT management platform.)
JumpCloud argues that enterprises must deploy IT processes to help protect the identity layer as AI impacts their business, “consolidating identity and access controls for both humans and bots to turn AI from a potential liability into a sustainable engine for growth.”
To support that transition, JumpCloud this week introduced a new investment arm to invest in companies building solutions around AI, security, identity and IT productivity. To an extent, this mirrors competitors in the burgeoning Apple-related IT space (Jamf Ventures, for example) even as it highlights the looming impact AI will have on this side of the market.
One of the first JumpCloud investments, Tofu, uses AI as part of its package of protections against identity fraud during the hiring and onboarding process, an emerging problem for some businesses. You could see Tofu’s tools as indicative of the speed at which AI is evolving.
Between the thought and the action lies the shadow
People don’t seem prepared for the consequences of the rapid evolution even though business leaders think they are. This gap between perceived preparedness and actual readiness comes after over a decade of rapid digital transformation. That transformation saw the iPhone-driven evolution of mobile business, the collapse of the former hegemonic Microsoft dominance of the enterprise, and an algorithmic assault on some of the principles that underpinned international trade.
The impact has been felt by every business, and entire business sectors have already been replaced by digitized alternatives. Our century so far has seen an avalanche of change, (remember “1,000 songs in your pocket”?) and enterprise leaders are struggling to keep pace, the JumpCloud survey shows.
Thought leaders have been discussing the need to adopt a new business mindset in which enterprises accept they live in an environment of constant change. These people say creative thinking and a willingness to embrace constant change will be the hallmarks of business success, but when technology moves faster than business leaders, the business environment itself becomes inevitably unstable.
When it comes to AI deployment, that means confidential data leaks, legal battles as regulators challenge those leaks, and the need to invest in managing digital transformation.
Faster than progress
AI development is accelerating. New models like GPT-5.3 Codex or Claude Opus 4.6 are insanely powerful and have now evolved something like autonomous discretion. That’s why they can create and iterate application code, which Xcode developers will be exploring now that tools have been made available to them.
It won’t end with code. You can see the direction of travel for yourself at METR, an organization that tracks how long it takes AI models to complete long tasks.
Anthropic CEO Dario Amodei tells it like it is when he says AI models “substantially smarter than almost all humans at almost all tasks” could arrive as soon as this year. He also says it might only be a couple of years until AI autonomously builds its own AI successors.
In the background, the leader of Anthropic’s Safeguards Research Team, Mrinank Sharma, just quit, warning the “world is in peril” from a series of interconnected crises, including AI. Think about that, think about the extent to which you and your business truly meet the standards of AI preparedness, and then consider the challenge it poses to IT decision makers working to keep their heads afloat amid this tsunami of change.
The gap between perceived and actual readiness is not just a statistic, it is a call to action for every leader. In a world where AI evolves so very quickly, true leadership requires us to prepare for the unknown. The experts say those who manage to stay afloat will be the ones who experiment today, and adapt tomorrow. While you do that, note that AI will be adapting at the very same time and probably faster, and is already in use, sanctioned, or unsanctioned, across your company.
Are you ready? Probably not yet.
Yes, the image to this story was created using AI.
You can follow me on social media! Join me on BlueSky, LinkedIn, and Mastodon.
AI, Apps, Cybersecurity, Data Breaches, Exploits, Global Security News, malware, Network Security, Risk Management
Software developers: Prime cyber targets and a rising risk vector for CISOs
Threats against corporate software developers are increasing and diversifying, challenging security leaders to develop more agile defenses against this growing attack vector. Attackers are increasingly targeting the tools, access, and trusted channels used by software developers rather than simply exploiting application bugs. The threats blend technical compromise — malicious packages, development pipeline abuse, etc. —…
AI, Apps, Cybersecurity, Data Breaches, Exploits, Global Security News, malware, Network Security, Risk Management
Software developers: Prime cyber targets and a rising risk vector for CISOs
Threats against corporate software developers are increasing and diversifying, challenging security leaders to develop more agile defenses against this growing attack vector. Attackers are increasingly targeting the tools, access, and trusted channels used by software developers rather than simply exploiting application bugs. The threats blend technical compromise — malicious packages, development pipeline abuse, etc. —…
