OX Security

TL;DR Application Security Posture Management (ASPM) pulls results from Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and Infrastructure as Code (IaC) scanners into one view.

TeamPCP went to jail, but the spirit of Shai-Hulud lives on: @7nohe/openapi-react-query-codegen was compromised, 128k weekly downloads affected Overview Less than 24h of TeamPCP's creators arrest in Australia, a new Shai-Hulud malware variant hits npm, sp

OX Security identified and is tracking a fake Cloudflare Captcha campaign that can potentially distribute ClickFix malware through npm, and found 24 distinct malicious packages sharing the exact same malicious code. Overview The OX Research team is tracki

Watch: AI Is Reshaping Supply Chain Security TL;DR An SBOM (Software Bill of Materials) is a point-in-time inventory of the components inside a software artifact. A PBOM (Pipeline Bill of Materials) (a standard originated by OX Security) is a continuously

Two flaws in GitLab's GraphQL API: one lets any user wipe or alter public projects and user data, the other quietly runs changes using a logged-in user's own permissions. Self-managed instances from 18.2 through 19.2 need to upgrade now. Overview On Augus

Breaking vm2's sandbox denylist forgot two modules: "os" and "dns." Under the wildcard config vm2's own docs recommend, that gap lets sandboxed code read the host process owner's identity and hijack the host's DNS with a single call - a change that outliv

5 days after 440+ npm packages were compromised, 5 malicious repositories remain live in the wild-and the threat is still active While the cybersecurity community was traveling to Black Hat last week, threat actors unleashed one of the most widespread sof

Frontier labs are catching autonomous models breaking containment. These aren't isolated harness bugs-they're the first observable data points of a system racing beyond our control. If you see one mouse, there are more in the walls. Frontier labs and safe

OX Research found and disclosed a Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin Vulnerability Details CVE: CVE-2026-44613 Description: Apache Zeppelin's default CORS configuration allowed cross-origin, credentialed, state-changing req

Keyv and Cacheable are affected with +440 Packages Compromised and Over 2B Monthly Downloads Breaking News: A new Shai-Hulud campaign, attributing itself as "Shai-Hulud: Here We Go Again", spreads in npm under filenames - math_init.js and Math_Symbol.js,