Computer Security Articles

Every post-quantum cryptography (PQC) roadmap opens with the same instruction: build an inventory of your cryptography. That is where most programs stall. The algorithms slated for replacement, including RSA and elliptic-curve cryptography (ECC) for key exchange and signatures and legacy primitives such as SHA-1, MD5, and DES, are rarely documented in one place. The hardest ones to find sit inside third-party and closed-source software, where nobody on the security team owns the data.Here’s what

Key takeawaysGlow researchers found AI agents pushed 13,000+ internal screenshots into public GitHub repos — not by going rogue, but by working around a technical limit to complete the task they were given.93% of the exposures landed in developers’personalrepos, outside any org-level governance, and the images included billing records, treasury consoles, tokens, and internal hostnames.Screenshots evade secrets scanners and DLP because those tools read text — and AI now makes mass image triage ch

The volume of malware on public repositories hasn’t decreased. ReversingLabs (RL) has never seen more malicious packages published on public repositories, and the overall count of malicious software is steadily rising. Looking at the metrics, npm saw around 5308 unique malicious packages published in 2024 (excluding spam). By August of this year, the number of malicious npm packages reached 5723, exceeding the total for all of 2024 in just eight months. And the number of malicious packages cont

Anthropic’s September report revealed that a Russia-linked threat actor was rebuilding flagged software implants with AI, making it hard to detect.However, ReversingLabs (RL) flagged the rebuilt malware two months before Anthropic did. And our data on the same malware shows that, while impressive, such AI powered tactics are not decisive. Instead, threat context behaviors and history are more critical than ever in spotting malware and improving the outcomes for targeted organizations.Here’s the

Many organizations still talk about the EU Cyber Resilience Act (CRA) as a 2027 problem. It stopped being one on Sept. 11, 2026. Since that date, manufacturers must report actively exploited vulnerabilities and severe incidents in products already on the EU market, legacy releases included. Full applicationfollows on Dec. 11, 2027, when every new product must meet the Annex I essential requirements, carry technical documentation, and bear the CE mark.Most CRA programs are being built from polici