13October 26, 2026 · 6 min readMALFEX: eight malicious npm packages, three payloads, and why --ignore-scripts isn't enoughA single operator spent three years publishing malicious npm packages that delivered a remote access trojan and a credential stealer to Windows developers. How MALFEX worked, which packages were involved, and how to check your own projects.CybersecurityNode.js
14October 26, 2026 · 6 min readPHP2Shell: two critical PHP core flaws, what they do, and how to actually fix themTwo unauthenticated remote code execution flaws in the PHP core (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) affect every version from 5.4 through 8.5.11. A detailed look at the bugs, the timeline, the conflicting exploitation reports, and a patching checklist.CybersecurityPHP
15October 7, 2026 · 4 min readVoluntary pledge vs. legal liability: two very different ways Washington is approaching AI agentsIn the same week, the White House announced a voluntary AI safety accord with six major companies and two senators introduced a bill that would make operators and developers liable for agent hacking. Here's what each actually does.AICybersecurity
16October 7, 2026 · 3 min readWhy open-source maintainers are closing the door on outside pull requestsOn October 1, Sindre Sorhus disabled external pull requests on all his repositories. He's not alone: curl, Ghostty, and Godot have all tightened contribution rules. Here's what's driving it, and why it matters if you build on open source.Software DevelopmentAI
17October 7, 2026 · 3 min readThe FBI job-portal breach: when an unpatched vendor system is your breachThe FBI removed a contractor after ShinyHunters exploited a patch that was available but never applied on its job portal. What happened, and why vendor patching belongs on your own risk list.Cybersecurity
18October 7, 2026 · 3 min readOpenAI DevDay 2026: agents that operate software the way people doOpenAI added computer use to its Agents API, moved Codex into shared cloud environments, and introduced a Decisions API. Here's what was announced, and what it changes for teams building with agents.AISoftware Development