Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On August 28, 2026, ten malicious versions of @7nohe/openapi-react-query-codegen were published to npm between 20:00 and 20:21 UTC. The package generates React Query hooks from an OpenAPI schema and draws roughly 150,000 weekly downloads. The latest tag pointed at the malicious 3.0.4 for the duration of the window. Eight of the ten releases carry a multi-stage loader that reaches for cloud, registry, and developer credentials. The attacker needed no stolen npm token and no hijacked maintainer account.

Broadcom’s acquisition has every IT leader re-examining their virtualization stack. Per CloudBolt’s February 2026 survey of 302 IT decisionmakers, 86% are actively reducing their VMware footprint, but only 4% have fully completed the move, and over 50% have changed strategy twice or more since the acquisition. That gap between intent and actualization tells a very specific story. Migrating away from VMware isn’t easy and may not lead to the outcomes those leaders were expecting.

When ransomware hits, decision makers face an impossible ultimatum: pay the ransom or lose business operations. In software development, data criticality also comes to the forefront. That’s because source code isn’t just some trivial data, but primary intellectual property and a revenue driver. Let’s see what’s exactly at stake and how you can minimize the risk of paying a ransom for your tech business.

OWASP published version 1.0 of the Agentic Skills Top 10 on August 17, defining ten risk classes for the layer where agents find, load, and run reusable instructions and code. This standard arrived while the problem was still forming, mapping directly to AISVS, the Agentic Security Initiative Top 10, the MCP Top 10, ISO/IEC 42001, and the NIST AI RMF. It ships with working code for signing, sandboxing, and pinning.

Cisco and Teleport are announcing a strategic partnership centered on deep technology integration, licensing, and investment. As the largest strategic investor, Cisco is reinforcing its commitment to accelerating the next phase of Teleport's evolution.

There is a public record of every TLS certificate ever issued for your domain, and anyone can search it. Most people who run infrastructure have never heard of these certificate transparency logs. So I read our own log, and here’s what anyone could learn about CertKit from them.

Regulation is doing more to shape backup strategy right now than almost anything else. NIS2 requires organizations to document their risk management measures, keep an incident response plan on file, and report breaches within 24 hours, with fines that can reach €10 million or 2% of global turnover. DORA goes further for financial entities, requiring documented recovery objectives, regular resilience testing, and an audit trail that holds up to a regulator’s questions.