Supply chain
Poisoned packages, hijacked releases and how to defend a build.
Review the Dockerfile your agent wrote
Agent-written Dockerfiles build, run and often ship your keys. Six things to check in review, what to change, and how to make the agent get them right first time.
A file in your Downloads folder can hijack your coding agent
A planted AGENTS.md told a coding agent to install a malicious npm package. How the attack works, why no patch fixes it, and what to change today.
Security roundup: 19–25 October 2026
LiteLLM poisoned on PyPI, exploited Arista, BeyondTrust and Ivanti bugs, Node.js and Brotli fixes, and an attack aimed at AI coding agents. What developers should patch.