Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

aikido

Compromised Flutter package on pub.dev contains XCSSET malware

Sep 8, 2026 By Ilyas Makari In Aikido
Today, pub.dev joins the list of package registries we have found malware on. We detected a variant of XCSSET hiding inside universal_file_viewer (version 0.1.5), a Flutter file preview package on pub.dev with around 500 downloads. This is the first compromised package we have detected on pub.dev, the official package repository for Dart and Flutter. Unlike the recent npm supply chain attacks you might be familiar with, this was not a case of someone deliberately targeting this package.
Read Post
aikido

Jason Haddix: Stop fearing AI pentesting

Sep 8, 2026 By Nicholas Thomson In Aikido
This post is based on Mackenzie's conversation with Jason Haddix on The Secure Disclosure podcast. Listen to the full episode or watch below. Jason Haddix has topped the Bugcrowd leaderboards, run security as CISO of Ubisoft, and wrote The Bug Hunter's Methodology, the playbook a lot of working pentesters learned from, so his read on the direction of the field is worth listening to. He believes that “90% of pen tests will be done by AI” in the near future.
Read Post

Securing autonomous AI agents: regulatory risk and governance for modern AppSec

Sep 7, 2026 By Mend In Mend
Autonomous AI agents writing and executing code at machine speed present an urgent compliance challenge for modern software organizations. As global regulations tighten, engineering leaders must establish clear governance layers over agentic workflows, external tool calls, and Model Context Protocol integrations to ensure full accountability. In this session, Mend.io experts Asaf Saar and Ben Goldberg unpack the intersection of AI compliance, software supply chain security, and enterprise risk management. Learn how to bridge the accountability gap without sacrificing development velocity.
View Video
aikido

Stop breaking SLAs: how to patch vulnerabilities before the fix even ships

Sep 4, 2026 By Shaun Brown In Aikido
You're almost out of time on an SLA on a critical dependency vulnerability, but you have no room in the current sprint for the manual testing needed to make sure you don't break production. Missing the remediation deadline itself is a finding in your next SOC 2 or ISO 27001 report, but the risk of exploitation is also growing with advancing AI models.
Read Post
aikido

MECCHA CHAMELEON can't hide from the RCE

Sep 3, 2026 By Robbe Van Roey In Aikido
TL;DR: We found another delayed RCE in MECCHA CHAMELEON. When playing on an attacker’s map, they can abuse an exposed function to arbitrarily write files to the victim’s system. This can lead to remote code execution on the victim’s system after a restart. We reported the issue to the game’s maintainers, and they fixed the vulnerability in the 4.0.0 update. This update is automatically installed before launching the game.
Read Post
aikido

The dark figure of supply chain detection

Sep 1, 2026 By Hunter Schwartz In Aikido
During World War II, Abraham Wald was asked where to add armor to bomber planes. The military's instinct was to study the planes that came back and reinforce wherever the bullet holes were clustered. Wald said to do the opposite. The planes in front of him had already survived hits to those spots. That's exactly why he could study them. The planes that took hits to the engine or the cockpit never made it back to be studied at all.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.