Security
ToolHive: Run Untrusted MCP Servers Without Handing Over Your Machine
ToolHive puts every MCP server in a container with a minimal permission profile. It shrinks the blast radius, it does not remove the bomb.
Tagged with
security
Security
CISA Left Its Own Keys on GitHub for Six Months
CISA leaked its own AWS keys on GitHub for six months
LLM
Mozilla Fixed 271 Firefox Security Bugs with Claude Mythos Preview
271 Firefox security bugs fixed with Claude Mythos Preview. 180 sec-high. Mozilla describes the dynamic change in their own words.
Open Source
Docker and Black Duck ship VEX-based CVE noise filter for containers
Docker + Black Duck auto-suppress phantom CVE alerts with VEX
Security
GitHub Patched a Critical git push RCE in Under Two Hours. GHES Admins Still Have Work.
GitHub disclosed CVE-2026-3854, where the friendly git push path became the RCE door.
DevEx
GitHub Introduces a Package Manager for Prompts, Supply Chain Headaches Included
'Skills are not verified by GitHub.' It's npm for prompts with a formal hands-off security policy.
Security
GlassWorm Uses Zig Dropper to Silently Infect Every IDE on Your Machine
One fake WakaTime extension on Open VSX, one Zig binary, and every VS Code-compatible editor on your machine is compromised in seconds.
AI Tools
OpenAI's macOS Signing Pipeline Got Hit by a 3-Hour npm Compromise
A floating semver tag in CI and a three-hour window on npm were enough for poisoned axios to reach code-signing certificates.