ReversingLabs

Every post-quantum cryptography (PQC) roadmap opens with the same instruction: build an inventory of your cryptography. That is where most programs stall. The algorithms slated for replacement, including RSA and elliptic-curve cryptography (ECC) for key exchange and signatures and legacy primitives such as SHA-1, MD5, and DES, are rarely documented in one place. The hardest ones to find sit inside third-party and closed-source software, where nobody on the security team owns the data.Here’s what

Key takeawaysGlow researchers found AI agents pushed 13,000+ internal screenshots into public GitHub repos — not by going rogue, but by working around a technical limit to complete the task they were given.93% of the exposures landed in developers’personalrepos, outside any org-level governance, and the images included billing records, treasury consoles, tokens, and internal hostnames.Screenshots evade secrets scanners and DLP because those tools read text — and AI now makes mass image triage ch

The volume of malware on public repositories hasn’t decreased. ReversingLabs (RL) has never seen more malicious packages published on public repositories, and the overall count of malicious software is steadily rising. Looking at the metrics, npm saw around 5308 unique malicious packages published in 2024 (excluding spam). By August of this year, the number of malicious npm packages reached 5723, exceeding the total for all of 2024 in just eight months. And the number of malicious packages cont

Anthropic’s September report revealed that a Russia-linked threat actor was rebuilding flagged software implants with AI, making it hard to detect.However, ReversingLabs (RL) flagged the rebuilt malware two months before Anthropic did. And our data on the same malware shows that, while impressive, such AI powered tactics are not decisive. Instead, threat context behaviors and history are more critical than ever in spotting malware and improving the outcomes for targeted organizations.Here’s the

Many organizations still talk about the EU Cyber Resilience Act (CRA) as a 2027 problem. It stopped being one on Sept. 11, 2026. Since that date, manufacturers must report actively exploited vulnerabilities and severe incidents in products already on the EU market, legacy releases included. Full applicationfollows on Dec. 11, 2027, when every new product must meet the Annex I essential requirements, carry technical documentation, and bear the CE mark.Most CRA programs are being built from polici

Key takeawaysnpm’s July fix has already been bypassed.Version 12 stopped running install scripts by default, but the malicious indexed-btree package hides its trigger in a prototype method. The malware runs when the app uses the library, not when it’s installed.A clean package.json is no longer a trust signal.Having no install hooks gave reviewers false comfort. This campaign targets that blind spot, and it backs the package with a fake GitHub repo and developer profile.Install-time checks aren’

Key takeawaysThe harness matters more than the model:Ridge Security’s benchmark of eight leading LLMs found that how well an AI does at autonomous pen testing depends more on the system around the model than on how smart the model is.Higher coverage costs a lot more:Grok 4.5 had the highest coverage at 77%, and Claude Opus 4.6 reached 63% at $217 per run. Smaller and open-source models like Gemini 3 Flash and GPT-OSS-120B cost a fraction of that, and a well-built harness can close much of the ga

RL researchers have uncovered a large-scale, coordinated supply chain attack targeting the@redhat-cloud-servicesnpm scope. On June 1, an attacker published malicious versions of 31 packages (update) in a 72-second window, injecting obfuscated preinstall malware into every one.The affected packages collectively represent approximately 9.8 million total downloads and cover the full breadth of Red Hat’s Hybrid Cloud Console JavaScript ecosystem — UI components, API clients, build tooling, configura