App security
Shipping an app also means understanding its exposure. Follow application security reports and defensive engineering developments, with original sources for context.
- Oct 19 UTCThe Verge AI
A hacker broke into John Deere and SharkNinja with an army of AI agents
AI security firm Norforge reported that a hacker used an army of largely autonomous AI agents to breach over 100 websites. According to Reuters, targets included John Deere, SharkNinja, and Cummins.
Why it matters Developers must secure applications against automated AI agent swarms capable of targeting systems at scale.
- Oct 19 UTCThe Hacker News
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
Elastic observed a fake Web3 accelerator distributing malicious npm packages. The campaign delivered backdoors and information stealers to Windows and macOS machines by luring targets with free Anthropic Claude and Google Gemini credits, coding tools, and security audits.
Why it matters Builders using third-party npm packages risk malware infections that can hijack systems, expose credentials, and compromise agent traffic.
- Oct 17 UTCBleepingComputer
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
ConnectWise shut down customer access to Cloud Backup, formerly SkyKick Cloud Backup, after hackers accessed application identities and compromised Microsoft 365 tenants.
Why it matters The breach highlights risks to Microsoft 365 tenants through third-party backup services.
Also covered by The Hacker News - Oct 17 UTCBleepingComputer
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal patched two critical vulnerabilities that could enable remote code execution on websites running supported versions. It warns that exploits may emerge soon.
Why it matters Builders using Drupal should note the patched flaws and the warning about potential exploits.
- Oct 17 UTCThe Hacker News
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
The package, named imgdecode, reportedly hides a shellcode loader in a Windows native addon. Uploaded on September 30, 2026, it had 979 downloads and remained available on npm when reported.
Why it matters Builders using npm packages may face supply-chain risks from malicious dependencies.