open source vulnerabilities

Sep 9

OpenAI's Artifactory enabled covert data theft via cross-account exploit

Source: The Register: Biting the hand that feeds

OpenAI's Artifactory artifact repository contained a critical vulnerability that allowed attackers to access data across isolated accounts—a flaw in the core architecture, not just authentication. The concurrent zero-day exploit on Hugging Face points to either coordinated reconnaissance of AI supply chains or shared design weaknesses now being hunted across similar platforms. AI companies storing proprietary model weights and training data in shared infrastructure face raised security risks, likely triggering audits of access logs and new requirements for air-gapped repositories.

theme-connected infrastructure security supply chain attack open source vulnerabilities

Jun 19

Hacker group exploited open source trust to poison 1,000+ packages

Source: Cyberscoop

TeamPCP's attack exposes a structural vulnerability in how developers distribute code. By compromising packages at the source rather than targeting individual users, they achieved scale impossible through traditional malware vectors. The attack shows that code repositories—long assumed to be trustworthy intermediaries—are now a viable attack surface. Enterprises will need to shift from verification-by-incident to verification-by-default in their dependency management.