Code analysis keeps pace with Vue and GitHub Actions
Security checks are most useful when they understand how an application actually works. New framework features and changes to build processes affect the way information flows through software. A scanner that does not recognise those patterns ma…
Leaked access keys do not stop at your own repository
An access key can escape a development environment without anyone deliberately sharing company information. An example project, a public bug report or a personal fork may be enough. Checking only an organisation’s own repositories therefore doe…
npm adds a safety pause after sensitive account changes
Software projects often depend on packages maintained by other developers. A compromised maintainer account can therefore affect far more than a single project. If an attacker uses that account to distribute a malicious update, organisations ma…
Key rotation underscores the importance of reliable updates
Reliable software updates start with the question of whether a package truly comes from the expected vendor. Digital signatures and the corresponding public keys play a central role in this. When a key is replaced as a precaution, administrator…
Stricter settings for AI with sensitive data
AI applications become more powerful once they can combine information from documents, apps, and the web. Those connections offer a lot of convenience, but they also increase the importance of a deliberate choice about which actions a system ma…
Trusted access for defensive cyber work
AI models can help security teams understand code, structure research, and accelerate defensive tasks. The same capabilities, however, call for careful boundaries: a request to find vulnerabilities can be part of responsible maintenance, but it…
CodeQL expands analysis for modern development stacks
Static code analysis is most useful when it aligns with the languages, frameworks, and patterns that development teams actually use. The new CodeQL release extends that alignment with support for recent versions of Swift, .NET, and C#, alongsid…
Handling Links Safely in AI Agents
AI agents are increasingly able to independently retrieve information, open web pages, and perform actions within connected systems. That makes them practically useful, but it also calls for a different view of links. A link is more than just a…
Critical vulnerability in React Server Components, developer urges immediate update
A critical vulnerability has been found in recent versions of Meta’s React Server Components. The company is asking users of the software to update immediately to a patched version. The flaw is rated 10/10. It concerns CVE-2025-55182, which al…