Plugin4Shell breaks SHA pinning in four AI coding agents at once
A shared design flaw lets attackers swap pinned plugin code in four major AI coding agents without any user action. Two vendors still have no fix.
Tagged
#supply chain security
Homebrew 7.0.0: what breaks on Monday and what to adopt
A migration walkthrough for Homebrew 7.0.0: the Intel Mac cliff, the CI and Brewfile flags that vanished, the Linux sandbox swap, and the two new commands worth adopting today.
RubyGems agent swarm: how three conveniences became RCE
The May RubyGems flood was reportedly an OpenAI training run looking for internet access. What the chain teaches maintainers, agent builders and anyone who owes a registry a heads-up.