Vercel breach exposes the OAuth gap most security teams cannot detect, scope or contain

One employee at Vercel adopted an AI tool. One employee at that AI vendor got hit with an infostealer. That combination created a walk-in path to Vercel’s production environments through an OAuth gr [...]

Capital One releases VulnHunter, an open-source AI tool that finds software flaws before hackers do

Capital One on Thursday released VulnHunter, an open-source, agentic AI security tool that scans source code for exploitable vulnerabilities, maps out how an attacker would reach them, and proposes ta [...]

GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hits Microsoft’s Python SDK

GitHub confirmed on May 20 that a poisoned VS Code extension installed on an employee’s device gave attackers access to roughly 3,800 internal repositories at the Microsoft-owned code storage and au [...]

The best password manager for 2025

Recently, we saw all the ways reused passwords can harm your security posture. The 23andMe attack comes to mind, but generally credential stuffing has been on the rise. Hackers can buy or find your re [...]

US employee screening firm DISA hit with data breach affecting over 3.3 million people

US-based employee screening services provider DISA Global Solutions said it was breached by hackers, putting the personally identifiable information of 3.3 million people at risk.<br /> While DI [...]

T-Mobile is under fire again over its 2021 data breach

T-Mobile is once again being sued by Washington state over the 2021 data breach which exposed sensitive information for over 79 million people, The Verge reports. The lawsuit filed on Monday alleges t [...]

In the wake of Claude Code's source code leak, 5 actions enterprise security leaders should take now

Every enterprise running AI coding agents has just lost a layer of defense. On March 31, Anthropic accidentally shipped a 59.8 MB source map file inside version 2.1.88 of its @anthropic-ai/claude-code [...]

DataGrail report finds your vendor may be sending data to AI models you never approved

The data processing agreement (DPA) — the bedrock contract companies use to evaluate how vendors handle personal data — can no longer be trusted at face value. That is the central, and arguably mo [...]

Prompt Security's Itamar Golan on why generative AI security requires building a category, not a feature

VentureBeat recently sat down (virtually) with Itamar Golan, co-founder and CEO of Prompt Security, to chat through the GenAI security challenges organizations of all sizes face. We talked about shado [...]