2432 articles
On May 14, 2026, multiple malicious versions of the popular npm package node-ipc were published to the npm registry. Current public reporting identifies node…
CPCSC compliance is coming fast. Learn how Chainguard helps Canadian defence suppliers meet Level 1 requirements with secure, zero-CVE containers.
Malicious node-ipc packages stole cloud, SSH, Kubernetes, and AI keys. Chainguard customers stayed protected through source-built libraries.
A new supply chain worm hit 400+ packages. Learn why preventive security, not reactive patching, is the only way to stop the next attack.
Elastic Security is the first security vendor to ship an interactive UI in AI tools. Triage alerts, hunt threats, correlate attack chains, and open cases, all from inside your AI conversation.
On May 11, 2026, a breach known as the Mini Shai-Hulud worm affected 84 npm package artifacts within 42 @tanstack/* packages, alongside others like @squawk/* and @mistralai/*. The attack utilized a GitHub Actions “Pwn Request,” cache poisoning, and extracted OIDC tokens from runner memory, marking it as the first npm supply chain attack to achieve valid SLSA Build Level 3 attestations. The article outlines the details of the incident, what was compromised, and necessary immediate actions for users.
Chainguard adds first-party RHEL 9/10 RPM compatibility and joins FINOS, helping financial institutions modernize securely for the AI-driven threat era.
This research analyzes the Linux kernel privilege escalation vulnerabilities Copy Fail and DirtyFrag, which exploit subtle page cache corruption bugs to create reliable paths to root access. Additionally, Elastic Security Labs is releasing detection logic for these vulnerabilities.
Learn how modern cyber resiliency helps organizations prevent, detect, and recover from supply chain attacks like Trivy, Axios, and LiteLLM.
This article shows how a customized Elastic Security ES|QL detection rule can identify web server probing and fuzzing activity in Traefik logs and automatically block the attacking IP via Cloudflare.
TL;DR AI-driven attacks on containerized environments are no longer theoretical. Frontier models can find vulnerabilities in hardened systems in hours and chain them into working exploits before your team has finished triaging the alert. When an attack moves that fast, the time your security program depends on between discovery and exploitation no longer exists. This
REF3076 uses a trojanized Logitech installer to deploy TCLBANKER, a Brazilian banking trojan with environment-gated payloads, WPF fraud overlays, and self-propagating WhatsApp and Outlook worm modules.