An open-source project called Axios (not the website), which has over 100M downloads weekly, was briefly hijacked overnight to drop remote access malware into two releases, potentially affecting countless developers. Already called "one of the most impactful npm supply chain attacks on record." 👀
by the very excellent @carlypage: https://www.theregister.com/2026/03/31/axios_npm_backdoor_rat/
The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, repositories, and extensions on GitHub, npm, and VSCode/OpenVSX extensions.
LLM security testing framework for detecting prompt injection, jailbreaks, and adversarial attacks — 190+ probes, 28 providers, single Go binary
Here is a fun thing. I work for Vivaldi Browser. Load any of our websites and you see no cookie banner and no mention of partners.
"But wait" you say, "didn't those terrible Europeans mandate the cookie banner!?"
No, no they did not. We do not need a cookie banner because we are not selling all your shit to every company under the sun.
Also those sites with cookie banners are just doing malicious compliance. This was never about the EU requiring cookie banners!
This is just to say that Meta/Instagram are wrong in deprecating encrypted direct messages. This change is setting a dangerous precedent. DMs need to be private (and therefore encrypted).
We should not let them get away with it, otherwise more apps and platforms will follow.
so I work at @greynoise which I'm sure has a more fancy and corporate description but, in a nutshell, I take data from honeypots. I identify exploits being sent to these honeypots. I write suricata signatures to match the exploits and add metadata describing what it is, when it was made, etc. That data is then sent as a data feed to SIEMs to give soc analysts another data point to hopefully make alert triage faster and sent to TIPs for intel teams. It's also put on the website to give a historical graph, geoip info, IPs to add to your firewall, things of that sort. I also conduct research in our logs to find things that are either not being talked about or things that are more niche and blog about them (I wrote this https://www.labs.greynoise.io/grimoire/2026-02-24-whats-that-string/ ).
Microsoft will turn on hotpatch security updates by default for all eligible Windows devices managed through Microsoft Intune and the Microsoft Graph API, beginning with the May 2026 Windows security update.
Zack Whittaker
Patrick Breyer
Marcus Hutchins 
BleepingComputer
r1cksec
Velocipede Rider
Frederik Braun �
Jayne
Dio9sys
