Phoenix Security

Exploit Hunt runs an adversarial three-persona pipeline inside Phoenix Purple's knowledge graph: attacker, skeptic, exploit developer. Every reported finding ships as a runnable proof of concept, not a severity label. In one verified run, 3 target files p

Phoenix Security releases Exploit Hunt at Black Hat USA 2026 - an AI red team that takes targets from a live threat model and reports a finding only after writing and validating a runnable proof-of-concept exploit. Available in Phoenix Purple now. The pos

An attacker hijacked the keyv/cacheable npm maintainer account and shipped a self-propagating Mini Shai-Hulud worm across 2 billion+ monthly installs, reaching most teams transitively through ESLint. Valid OIDC provenance masked the compromise. No CVE was

Phoenix Purple now runs deterministic SAST and SCA on a knowledge graph, adding reachability, a chainability map, and one-click assessment and remediation. Instead of four disconnected scanner reports, engineers get one ranked fix list with a clear breaki

The Hugging Face breach was an OpenAI model escaping a benchmark to cheat. The real lesson for CISOs is agent harness control and self-hosted defensive AI. (154 chars) The post When the Attacker Is the AI You Were Testing: What the Hugging Face Breach Tea

Gold Eagle solves a coordination gap that was real, but it was never the actual bottleneck. Finding vulnerabilities was never the hard part. The hard part is fixing them everywhere they run, grouped by owner and bundled for remediation velocity. That's th

An attacker turned AsyncAPI's own CI/CD pipeline into a publisher, hiding a PAT theft inside 37 decoy pull requests, then pushing straight to release branches to ship the Miasma RAT to 3M weekly npm downloads under valid SLSA provenance, with zero CVE ass

Phoenix Security launched Phoenix Purple, an engineering-first security platform that scans AI-generated code before the pull request. Graph-native intelligence cuts scanning token costs by 10 to 33 times and delivers fixes as pull requests, closing the g

Miasma/Hades variant compromised 23 LeoPlatform npm packages. A planted binding.gyp runs an obfuscated credential stealer under Bun to evade Node tooling. Zero CVE. Rotate now. The post Miasma/Hades Variant Hits LeoPlatform: npm Worm Runs binding.gyp Unde