Computer Security Articles

RL has discovered an active Microsoft 365 device code phishing campaign that abuses Microsoft’s legitimate OAuth 2.0 Device Authorization Grant flow to obtain access to victim accounts.Rather than stealing passwords through a counterfeit login page, the phishing kit persuades victims to complete a legitimate Microsoft authentication process that authorizes an attacker-controlled device.Here’s how it works, complete with phishing lure, attack workflow, landing page code, network indicators, and d

A longstanding security deficiency in the popular npm package manager — having the installation of scripts turned on by default — will be addressed in the next version of the software, expected to be released in July.The change, in version 12 of npm, meansthe commandnpm-installwill no longer execute preinstall, install, or postinstall scripts from dependencies unless they are explicitly allowed in a project,the npm team explained in a GitHub blog.For years, a single compromised package could run

RL researchers have uncovered a large-scale, coordinated supply chain attack targeting the@redhat-cloud-servicesnpm scope. On June 1, an attacker published malicious versions of 31 packages (update) in a 72-second window, injecting obfuscated preinstall malware into every one.The affected packages collectively represent approximately 9.8 million total downloads and cover the full breadth of Red Hat’s Hybrid Cloud Console JavaScript ecosystem — UI components, API clients, build tooling, configura

The rapid adoption of AI coding agents is outpacing the security controls organizations have put in place to govern them.According to JetBrains’ 2025 Developer Survey,85% of developersnow regularly use AI tools for coding and development, and 62% use at least one AI coding assistant.Gartnerprojects that figure will reach 90% of enterprise software engineers by 2028.The security implications are significant. Coding agents have broad access to source code, repositories, credentials, and CI/CD pipe

With artificial intelligence, trust isn’t what it used to be. AI is prodding security teams to move from static, binary, identity-based trust toward dynamic, probabilistic, behavior-based trust. They’re also adjusting to a shift in security from the component layer of applications to the data layer.AI pushes a meaningful portion of security risk up from static components — libraries, services, containers — and into the data and context the system consumes at runtime, said Christopher Jess, senio

In the space of a few years, software supply chain security has moved from a niche problem to a major threat and board-level concern for most companies. Every organization depends on software built from code, components, services and AI models created by people they’ll never meet and by organizations they’ll never be able to directly assess.That’s why as the CEO of ReversingLabs, I am thrilled that Gartner® has issued its inaugural Magic Quadrant™ for Software Supply Chain Security (SSCS) — and

Emerging AI frontier models could be the impetus that gets security professionals to finally tackle the tough job of fixingbroken vulnerability management practices. Security strategists see Mythos and its ilk as engines for dangerously increasing exploitation risks — but  also as the tools that will make it possible to bring to fruition all of those elusive VM improvements that have been out of reach for so long.Take the push for continuous threat exposure management (CTEM), which emphasizes do

Frontier AI models such as Anthropic’s Mythos and ChatGPT-5.5-Cyber are creating a dangerous imbalance in the open-source supply chain by unearthing new vulnerabilities far faster than the ecosystem’s capacity to remediate them — giving rise to the so-called vulnpocalypse.The AI labs opening that asymmetry should help close it by investing in remediation at equal scale, argues Jen Easterly, the former director of the U.S. Cybersecurity Infrastructure and Security Agency, who is calling on the Un