One expert said they were pleased by the guidance, which touches on open-weight AI models, patching and more.

Amazon's threat intelligence team traced domain records from the open-source software hack to a smaller, earlier compromise by the same North Korean group.

The worm blends in with thousands of other commands occurring daily in any given environment, yet its intent and origins remain unknown.

The government's new AI clearinghouse risks becoming a committee that discovers more problems than it solves — unless it's designed around patching, not just scanning.

A diffuse landscape, fruitful targets, companies not stepping up, AI’s influence and flagging U.S. government efforts all figure into a shifting threat.

The threat group’s remarkable success targeting open-source software was inevitable and fueled by the industry’s decision to prioritize code shipping over security.

Acting director Nick Andersen’s comments came as a wave of malware attacks hit tech that’s publicly available for collaboration.

Microsoft’s AI red team lead talked to CyberScoop about the goals behind open sourcing a pair of security tools meant for developers and incident responders.

Another malware wave is washing through open-source software repos, stealing publishing tokens, installing OS‑level backdoors and persisting in developer tools and CI pipelines.

The company said it found more evidence of compromise across its customer base. Exposure, which has yet to be defined, poses significant downstream risk.