// security

All signals tagged with this topic

Jul 14

Bots Now Outnumber Humans on the Web

Cloudflare's data showing bot traffic surpassing human traffic for the first time marks a shift in internet infrastructure: the web was built by humans for humans, but is now predominantly machine-to-machine, with human activity as the minority use case. The company's shift toward bot-aware defense systems like Precursor reflects a change in security philosophy. Treating bot traffic as an attack vector is no longer workable; platforms must now architect security around selective bot allowance while filtering malicious automated activity. This inverts decades of assume-good-faith design. The economics change across advertising, analytics, API design, and content delivery: the meaningful metric is no longer pageviews or sessions, but authenticated intent.

theme-connected security supply chain infrastructure

Jul 4

North Korean hackers exploit npm to target open source developers

Source: The Next Web

JFrog's discovery of North Korean-backed packages masquerading as Rollup polyfills shows state-sponsored attackers shifting tactics: instead of targeting corporate networks directly, they're poisoning the software supply chain by compromising tools developers trust. The attack exploits an imbalance in open source security—package maintainers lack resources for rigorous vetting while millions of downstream projects automatically inherit compromised code, turning a single malicious upload into a breach vector across entire development ecosystems. By impersonating legitimate build tools, state actors signal they now view developer infrastructure as a higher-value target than endpoint security, since compromised build systems can harvest secrets and inject backdoors at scale.

theme-consumer privacy trust security

Jun 26

Fake Freelance Job Offers Hide Malware in npm Packages

Source: Indieblog

A Turkish developer discovered a seemingly legitimate NFT staking project pitch that contained a typosquatted npm package designed to steal browser credentials and wallet data—a social engineering attack targeting creators in crypto work-for-hire spaces. The compromise operated at the behavioral level, exploiting freelancers' information-seeking instincts rather than code vulnerabilities alone, making vetting harder for solo workers without institutional security teams. The attack exploited a specific economic desperation: developers and creators pursuing quick crypto gigs are least likely to scrutinize package dependencies or job legitimacy before installing tools.

theme-connected hardware security cpu design

Jun 23

AMD Restores Memory Encryption After User Backlash

Source: Slashdot: Hardware

AMD removed SME (Secure Memory Encryption) from Ryzen 7000-series chips without disclosure. The move exposed a pattern of silent feature degradation in consumer silicon—security downgrades that typically happen in enterprise products first, then spread unnoticed to consumer lines. AMD reversed course only after public pressure, not proactive communication. The incident reveals AMD felt little institutional responsibility until users made removal costly. This matters because the spec sheet is no longer a reliable contract. Buyers can no longer assume that capabilities present in prior generations will remain unless explicitly guaranteed. Hardware security features now require consumer vigilance to protect.

theme-culture security policy regulation

Jun 20

Supply Chain Attacks Are Now Easier Than Breaking In

Source: The Next Web

The shift from hacking exploits to exploiting trusted infrastructure—like package managers, CI/CD pipelines, and open-source dependencies—reflects a stark asymmetry: developers have optimized for speed and convenience, not adversarial resilience. This matters because it moves the attack surface from heavily defended perimeters to the unglamorous maintenance work that underpins modern software, where a single compromised library can infect thousands of downstream projects before detection. Attackers no longer need zero-days or sophisticated techniques when they can submit a pull request to a popular repo or register a typosquatted package name.

theme-ai AI & ML security

Jun 9

Lab Creates Self-Propagating AI Worm, Moving Autonomous Malware From Theory To Practice

Source: Featured Blogs - Forrester

Researchers have demonstrated a working proof-of-concept for AI-driven malware that can identify and exploit vulnerabilities without human intervention. This collapses the assumption that autonomous attack vectors remain years away. The security industry's planning horizon shifts from "if" to "when." Defensive architectures that currently depend on human-in-the-loop incident response and signature-based detection now require immediate recalibration. The lab prototype shows that the adversary economics of malware—cost, scalability, targeting precision—are about to invert in favor of attackers with access to capable AI systems.

theme-consumer trust security platform dynamics

Jun 4

Popular npm package stole developer tokens for a month undetected

Source: The Next Web

A code generation tool with 29,000 weekly downloads demonstrates how supply chain attacks exploit the open-source ecosystem's trust assumptions. Developers rarely audit dependencies, and package metadata—stars, download counts, maintenance history—now serve as effective camouflage for malware. AI coding assistants have become critical infrastructure for software teams, making them high-value targets for credential theft that can cascade into enterprise breaches. The npm ecosystem still lacks meaningful verification standards between publication and widespread adoption.

theme-connected security supply chain infrastructure

Jun 2

Red Hat's NPM Account Compromised, Spreading Malware Through Official Packages

Source: Ars Technica

Red Hat's developer tooling infrastructure became a distribution vector for a self-propagating worm, exposing the vulnerability of trusted package repositories even when properly authenticated. Unlike typical supply chain attacks, this one compromised the identity layer itself; developers installing legitimate-looking packages from verified accounts still got infected, rendering standard verification practices insufficient. The incident shows that as development environments become more interconnected through package managers, a single compromised credential can cascade through thousands of downstream projects before detection.

theme-culture regulation/policy security geopolitics

Jun 1

Western AI Models Are Enabling Iranian Cyber Operations

Source: Financial Times

Iranian state-sponsored hackers are using unrestricted access to ChatGPT and Gemini to accelerate malware development and social engineering at scale. AI commodity tools have flattened technical barriers that once protected Western infrastructure. The asymmetry is direct: Western intelligence agencies designed these tools with safety guardrails for domestic users, but geopolitical adversaries operate outside those constraints and can rapidly iterate on attack vectors that previously required specialist knowledge. State-sponsored cyber campaigns against lower-resource targets now carry better odds at lower cost.

theme-culture regulation/policy security open source

May 24

AI Mining Open Source Code for Zero-Day Vulnerabilities

Source: The Register: Biting the hand that feeds

Security researchers are detecting a new attack pattern where AI systems systematically scan public code repositories to identify exploitable vulnerabilities before patches exist, turning open-source transparency into a liability. The traditional assumption that "many eyes make all bugs shallow" now competes with the reality that automated vulnerability hunting operates faster than human-driven disclosure cycles. Enterprises running popular open-source dependencies face the highest risk, as the window between AI discovery and weaponization may shrink below the time needed for coordinated patching.

theme-culture security policy regulation

May 23

Hackers Are Poisoning Open Source Code at Scale

Source: Ars Technica

The shift from targeted supply chain attacks to mass contamination represents a change in threat model. When adversaries move from surgical strikes on specific projects to broad pollution of the commons, they're signaling both technical capability and a bet that defenders are overwhelmed—the economic equation has flipped where damage-per-effort now favors attackers. This forces a reckoning for the open source ecosystem's governance model: if the cost of verification exceeds the value of "free" dependencies, maintainers and enterprises face a choice between lockdown-heavy solutions or accepting a permanent baseline of compromise risk.

theme-connected infrastructure security data centers

May 8

AI Infrastructure Security Demands Enterprise Redesign

Source: SiliconANGLE

As organizations deploy AI factories—centralized platforms that continuously train, fine-tune, and serve models at scale—traditional perimeter-based security models fail because data flows in loops between training pipelines, vector databases, and inference endpoints rather than following linear input-output paths. The attack surface expands: prompt injection, model poisoning, and unauthorized fine-tuning on proprietary data now compete with classical infrastructure threats, forcing CISOs to architect security around data lineage and model provenance rather than network segmentation alone. OpenAI and Anthropic have already demonstrated the cost of getting this wrong through jailbreaks and data leaks; enterprises copying their architecture without building native security controls will face similar exposure at scale.