wp2shell: Critical WordPress vulnerability allows code injection via API

By chaining an SQL injection and an API vulnerability, attackers can inject code. WordPress has released an update, the ...

'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets

A PNG hiding a prompt injection could steal your repo's secrets, researchers demonstrate. The technique, dubbed 'Ghostcommit, ...
VentureBeat

Three AI coding agents leaked secrets through a single prompt injection. One vendor's system card predicted it

A security researcher, working with colleagues at Johns Hopkins University, opened a GitHub pull request, typed a malicious instruction into the PR title, and watched Anthropic’s Claude Code Security ...
Tech Times on MSN

GitHub Copilot app now scans in-flight code for vulnerabilities before commit

GitHub Copilot security review launched in the desktop app July 14, giving all subscribers — Free tier included — AI-driven ...
Ars Technica

Fed up with vibe coders, dev sneaks data-nuking prompt injection into their code

The controversy over vibe coding reached a new high this week after a developer added hidden instructions to his open source Java testing app to sabotage projects performed by AI coding agents. The ...