Computer Security Articles

RL researchers have uncovered a large-scale, coordinated supply chain attack targeting the@redhat-cloud-servicesnpm scope. On June 1, an attacker published malicious versions of 31 packages (update) in a 72-second window, injecting obfuscated preinstall malware into every one.The affected packages collectively represent approximately 9.8 million total downloads and cover the full breadth of Red Hat’s Hybrid Cloud Console JavaScript ecosystem — UI components, API clients, build tooling, configura

With artificial intelligence, trust isn’t what it used to be. AI is prodding security teams to move from static, binary, identity-based trust toward dynamic, probabilistic, behavior-based trust. They’re also adjusting to a shift in security from the component layer of applications to the data layer.AI pushes a meaningful portion of security risk up from static components — libraries, services, containers — and into the data and context the system consumes at runtime, said Christopher Jess, senio

In 2026, supply chain attacks took center stage. Thespring was a stormof open source packages being compromised into pushing malicious updates, infecting a variety of targets and causinguntold amounts of damages. Recently, two actors associated withTeamPCP were arrested. TeamPCP was responsible for many of the recent supply chain compromises, making this an apt time to reflect on those attacks. This retrospective covers attacks from late 2025 to present day, explains how and why they work — and

A longstanding security deficiency in the popular npm package manager — having the installation of scripts turned on by default — will be addressed in the next version of the software, expected to be released in July.The change, in version 12 of npm, meansthe commandnpm-installwill no longer execute preinstall, install, or postinstall scripts from dependencies unless they are explicitly allowed in a project,the npm team explained in a GitHub blog.For years, a single compromised package could run

In the space of a few years, software supply chain security has moved from a niche problem to a major threat and board-level concern for most companies. Every organization depends on software built from code, components, services and AI models created by people they’ll never meet and by organizations they’ll never be able to directly assess.That’s why as the CEO of ReversingLabs, I am thrilled that Gartner® has issued its inaugural Magic Quadrant™ for Software Supply Chain Security (SSCS) — and

It started with a phone call from a friend. He’d tried to log into his university’s Student Association website — a site he used constantly and trusted — and hit a strange CAPTCHA screen. Something felt off. He asked me to take a look.I did. Working with RL’s Spectra Analyze, I ran interactive dynamic analysis. What I found was a textbook ClickFix attack. The student site was compromised and used as a “watering hole” to draw in potential victims. Key to the attack was a pixel-perfect fake Google

Key takeawaysClaude Code Security uses AI reasoning to find logic-level flaws that rules-based SAST misses. Anthropic says it found 500+ overlooked vulnerabilities.It could sharply cut SAST false positives, which run from 68% to 91%.It only sees source code, so it misses deployed artifacts and supply chain attacks like SolarWinds and Log4Shell.It adds to a full AppSec program; it doesn’t replace one.Claude Code Security has attracted considerable attention because it brings AI reasoning directly