#security

A widely discussed Hacker News thread elevated a forensic report claiming that a buyer inserted a dormant backdoor into more than 30 WordPress plugins, then activated it months later.

GitHub now lets users assign Dependabot alerts to AI coding agents including Copilot, Claude, and Codex. The agents can analyze the advisory, open a draft pull request, and attempt to fix test failures, but GitHub says humans still need to review the output before merging.

Rockstar has acknowledged that a third-party breach exposed a limited amount of non-material company information, while saying the incident had no impact on the company or its players. The statement shifts the story from hacker claims to an officially confirmed security incident, even if the publisher is downplaying the practical fallout.

OpenAI said a compromised Axios package reached a GitHub Actions workflow used in its macOS app-signing pipeline. The company said it found no evidence of user data or product compromise, but is rotating certificates and requiring users to update macOS apps.

OpenAI on March 25 launched a public Safety Bug Bounty program on Bugcrowd for AI abuse, agentic misuse, and platform-integrity reports. The company says the new track complements its existing Security Bug Bounty rather than replacing it.

UC Berkeley researchers say eight major AI agent benchmarks can be driven to near-perfect scores without actually solving the underlying tasks. Their warning is straightforward: leaderboard numbers are only as trustworthy as the evaluation design behind them.

Microsoft described a widespread device code phishing campaign that uses AI-driven automation to compromise organizational accounts at scale. The attack abuses legitimate OAuth device code flows, dynamic code generation, and backend polling infrastructure.

OpenAI said on April 10, 2026 that a compromised Axios package touched a GitHub Actions workflow used in its macOS app-signing pipeline. The company says no user data, systems, or software were compromised, but macOS users need updated builds signed with a new certificate before May 8, 2026.

The Indie Stone says a malicious mod exploit affected Project Zomboid Build 42, leading to 14 Workshop uploads being removed and users being told to take extra security steps.

An HN discussion around Cloudflare’s roadmap highlights a security story with direct IT relevance: the company now targets 2029 for full post-quantum protection, including authentication, because recent quantum and algorithmic advances are compressing the migration timeline.

A Hacker News thread amplified Nicholas Carlini's report that Claude Code helped uncover remotely exploitable Linux kernel bugs, including one introduced in 2003. The case suggests frontier coding models are becoming useful vulnerability discovery tools even before they become strong automated exploit builders.

Hacker News pushed CVE-2026-33579 into wider view after NVD described a high-severity OpenClaw flaw in the `/pair approve` path. The issue could let a user without admin rights approve broader device scopes, which turned the thread into a discussion about why AI coding tools now need normal authorization engineering.