Docker

QuoteBench is a new benchmarking framework that exposes how the execution environment of LLM agents can corrupt Bash commands through parsing errors. It demonstrates that high 'matched' success scores often hide significant failures occurring at the boundary between model output and shell execution.

The article advocates for a proactive 'sniff test' methodology to validate the integrity of SBOMs in containerized environments. It highlights how identifying omissions like unpinned packages or missing dependencies is crucial for preventing supply chain attacks.

An audit of the OpenReception medical booking platform uncovered 16 vulnerabilities, featuring critical flaws in authorization logic. These exploits allow attackers to escalate privileges to global administrator and compromise the platform's core end-to-end encryption feature.

Kuma introduces a way to run trained PyTorch models live in the browser by compiling them into a specialized '.iph' format. By leveraging WebGPU and embedded WGSL shaders, it eliminates the need for server-side inference or heavy runtime dependencies.

More than 30 Red Hat npm packages were compromised in a supply-chain attack using the Miasma malware to steal developer credentials. The attack was executed via a compromised GitHub account and targeted various cloud and infrastructure secrets.

This report details the rising trend of opportunistic scanning targeting AI-related services and infrastructure. It highlights specific threats to unauthenticated Ollama instances and the use of coordinated sweeps to harvest AI API keys from configuration files.

The TeamPCP hacker group has compromised the Checkmarx Jenkins AST plugin by leveraging credentials stolen from a previous Trivy scanner breach. This supply-chain attack allows for the delivery of credential-stealing malware to developer environments.