Claude Chrome extension flaw lets malicious extensions trigger AI actions

A flaw in Anthropic's Claude for Chrome browser extension could allow a malicious extension to trigger predefined AI actions ...
Microsoft

Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This ...
InfoQ

Google's Genkit Ships Agents API with Detached Turns and Human-in-the-Loop for TypeScript and Go

Google released the Genkit Agents API in preview for TypeScript and Go. The open-source framework packages message history, ...
The Hacker News

Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365

An exposed attack server led Lexfo to three Microsoft 365 phishing operations using Evilginx and device code abuse to capture ...
The Hacker News

Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions

Zimbra fixes a critical stored XSS flaw in its Classic Web Client that could let crafted emails run malicious scripts when ...