npm's Keyv and Cacheable Hijacked in 'Mini Shai-Hulud' Supply-Chain Worm
A hijacked maintainer account let attackers trojan keyv, cacheable-request and flat-cache — reusing the same Shai-Hulud toolkit seen on PyPI and npm earlier in 2026.
The "Meat Proxy" Problem: Why Unread AI Output Is a Security Risk
A new term for an old failure mode — relaying AI output without reading it — has real consequences when the output is a vulnerability triage, an incident runbook, or a pull request.
CVE-2026-63077: Critical TeamCity Flaw Enables Unauthenticated RCE
A critical bug in the agent polling protocol lets an unauthenticated attacker with network access to a TeamCity On-Premises server run arbitrary OS commands — no credentials required.
Lobste.rs moves to SQLite: a lesson in shrinking your attack surface
The tech-news community site Lobsters has retired MariaDB in favour of SQLite after an eight-year migration effort — a small architectural decision with a useful security lesson about trading network attack surface for single-host risk.
AI Writes the CI/CD Pipeline: Auditing AI-Generated GitHub Actions Workflows
Simon Willison's browser-compat-db used two AI models to generate a complete build pipeline — a sign of where development is heading and a prompt to ask whether security review has kept pace.