Flux
Couleur d'accent
Toutes les sources

Socket

130 articles Flux RSS
Cybersécurité Programmation
PHP and Composer Support Is Now in Beta Récent
Cybersécurité Programmation

PHP and Composer Support Is Now in Beta

Today, Socket’s PHP and Composer support is moving from Experimental to Beta and is now enabled for all customers. PHP reachability analysis is also generally available, helping teams determine which vulnerabilities in their dependencies can be reached from their application code. We introduced PHP and Composer support earlier this year with package search, dependency scanning, SBOM generation, CVE detection, and AI-powered analysis for Packagist packages. Moving to Beta makes that protection…

Socket
Socket Now Protects the Firefox Extension Ecosystem
Cybersécurité Programmation

Socket Now Protects the Firefox Extension Ecosystem

Today, Socket is expanding its browser extension security coverage to Firefox, giving security teams visibility into the extensions used across their organizations and helping them identify malicious behavior, excessive permissions, data collection, suspicious infrastructure, and risky changes between versions. Socket now proactively scans every Firefox extension listed in Mozilla's official addons.mozilla.org directory. At the time of publication, Mozilla's public API lists 97,100…

Socket
Popular Rust Crates Compromised in Build-Time Supply Chain Attack
Cybersécurité Programmation

Popular Rust Crates Compromised in Build-Time Supply Chain Attack

A threat actor compromised legitimate Rust crates and injected a malicious proc-macro1 dependency that executed cross-platform malware automatically during Cargo builds. Socket’s Threat Research Team analyzed a coordinated supply chain attack affecting three legitimate Rust crates maintained by David Roundy (droundy): arrayref@0.3.10 internment@0.8.7 append-only-vec@0.1.9 Socket’s AI Scanner independently detected the malicious proc-macro1 crate on August 20, 2026 at 07:29:50 UTC. At that point…

Socket
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Cybersécurité Programmation

77 Firefox Extensions Linked to Crypto Wallet and Credential Theft

Socket identified 40 malicious extensions that steal wallet secrets or credentials, plus 37 deceptive sports-score shells linked through shared code, infrastructure, publishing artifacts, and version histories. The Socket Threat Research team is tracking 77 Firefox extension identities linked through code reuse, cloned extensions, deceptive marketplace descriptions, author-selected add-on ID patterns and domain-like suffixes, cryptocurrency-wallet impersonation, and version histories showing…

Socket
NIST Proposes AI-Enabled NVD Overhaul After Cutting Routine CVE Enrichment
Cybersécurité Programmation

NIST Proposes AI-Enabled NVD Overhaul After Cutting Routine CVE Enrichment

The National Institute of Standards and Technology is asking the cybersecurity community how artificial intelligence should reshape the National Vulnerability Database, more than two years after the agency began publicly pointing to automation as a solution for its growing vulnerability processing problems. The Request for Information seeks input on improving the NVD's "scalability, automation, interoperability, transparency, and utility." A separate NIST blog post accompanying the RFI…

Socket
How AI Agents Expand the Software Supply Chain Attack Surface
Cybersécurité Programmation

How AI Agents Expand the Software Supply Chain Attack Surface

At AI Council 2026, Socket founder and CEO Feross Aboukhadijeh examined how coding agents are changing the software supply chain threat model. Agents can select dependencies, connect to MCP servers, install skills, and execute code with developer credentials, often without a human reviewing those decisions. The talk highlights three important developments: AI agents increasingly choose, install, and run third-party code. Existing security infrastructure assumes humans make those trust…

Socket
White House Authorizes Private Companies to Conduct Offensive Cyber Operations
Cybersécurité Programmation

White House Authorizes Private Companies to Conduct Offensive Cyber Operations

The White House is creating a program that will allow vetted U.S. companies to conduct offensive cyber operations against foreign cybercrime groups under federal direction. The presidential memorandum creates a formal path for private companies to perform work usually associated with government cyber operators. Participating firms could covertly access criminal systems, collect intelligence, disrupt networks, manipulate infrastructure, or destroy data after receiving approval from the…

Socket
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
Cybersécurité Programmation

737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection

Socket's Threat Research Team identified a campaign of 737 free VPN and proxy extensions published across at least 40 Chrome Web Store developer accounts, 274 of which impersonate 66 established VPN and privacy brands, that route the user's entire browser session through SOCKS5 proxies operated by a single provider. Socket analyzed the code of 525 of them, 522 from bulk retrieval and 3 more found during store enumeration; the remaining 212 had been removed from the store before collection and…

Socket
Free Business Plan Upgrades for Open Source Maintainers
Cybersécurité Programmation

Free Business Plan Upgrades for Open Source Maintainers

This week our Threat Research team tracked an active supply chain attack that took over a maintainer account and used it to push malware across the widely used keyv and cacheable packages, then spread to other maintainers through stolen npm tokens. Those packages sit deep in dependency trees and account for tens of millions of weekly downloads. Attacks like this are getting more frequent, and open source maintainers are the ones on the receiving end. When an account takeover happens, the…

Socket
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
Cybersécurité Programmation

Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache

Bundler 4.0.18 adds the opt-in --cooldown flag to bundle lock and bundle cache, closing gaps where the setting could not be applied. Bundler 4.0.18, released August 5, 2026 alongside RubyGems 4.0.18, extends the cooldown feature to two more commands. The opt-in --cooldown flag now works with bundle lock and bundle cache, which previously resolved dependencies without accepting the flag. RubyGems lists the change under Bundler security in the release notes. The cooldown feature is not new. It…

Socket
UK Cyber Test: AI Agent Attempted to Social Engineer Open Source Maintainer Into Merging Malware
Cybersécurité Programmation

UK Cyber Test: AI Agent Attempted to Social Engineer Open Source Maintainer Into Merging Malware

An AI agent powered by Anthropic’s Mythos 5 created a malicious pull request, fabricated identities, targeted open source maintainers, and planted instructions for other coding agents during a UK government cybersecurity evaluation. The UK AI Security Institute (AISI) disclosed on August 4 that frontier AI agents took 19 unsanctioned actions on the live internet during a cybersecurity evaluation, including an attempted supply chain attack against a real open source project. The most serious run…

Socket
AWS Security Hub Adds Socket for Supply Chain Security
Cybersécurité Programmation

AWS Security Hub Adds Socket for Supply Chain Security

Amazon Web Services (AWS) customers can now adopt Socket directly through the AWS Security Hub Extended plan, apply committed AWS spend, and start with the first month free. Socket covers supply chain security in the program, with deep behavioral analysis that catches malicious packages signature-based tools miss. Supply chain security in the Extended plan # The AWS Security Hub Extended plan brings curated third-party security tools into AWS across 10 security categories, with pay-as-you-go…

Socket
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Cybersécurité Programmation

Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack

Socket’s Threat Research Team is tracking an active supply chain compromise affecting the widely used keyv and cacheable npm packages. On August 4, 2026, at least ten packages beginning with the keyv and cacheable namespaces and spreading to packages owned by other maintainers, were published with a malicious preinstall hook (setup.mjs) that downloads a standalone Bun runtime, executes an obfuscated second stage, harvests cloud and CI credentials, and republishes trojanized versions of other…

Socket
Claude Breached 3 Companies and Uploaded Malware to PyPI During Anthropic's Security Tests
Cybersécurité Programmation

Claude Breached 3 Companies and Uploaded Malware to PyPI During Anthropic's Security Tests

Anthropic disclosed three incidents in which a Claude model reached the open internet during cybersecurity evaluations that were supposed to run in sealed environments, then broke into an organization's production systems. Each incident involved a different Claude model and a different organization. In one, a model built and published a malicious Python package to PyPI, where it ran on 15 real systems before the registry removed it. On July 30, Anthropic's Frontier Red Team published a report…

Socket
Socket Is Sponsoring Composer and Packagist
Cybersécurité Programmation

Socket Is Sponsoring Composer and Packagist

Socket is a launch sponsor of the new Composer and Packagist sponsorship program, announced by Nils Adermann, Jordi Boggiano, and the team that keeps PHP's package infrastructure running. Like many other widely used open source registries, Packagist has been under mounting pressure to sustain critical infrastructure as the demands on it grow. "Usage keeps rising, supply chain attacks have increased in both frequency and sophistication, regulatory and compliance requirements around software…

Socket
Esc