Chun Wang, co-founder of the Bitcoin mining pool F2Pool and commander of SpaceX’s Fram2 private astronaut flight, has been named for Starship’s first interplanetary human spaceflight mission, a planned Mars fly-by that places a cryptocurrency entrepreneur at the centre of one of the most ambitious commercial space ventures yet announced. The mission is designed as a two-year journey beyond the Earth-Moon system, flying past Mars before returning […]
Seychelles and Bangladesh have moved to accelerate bilateral cooperation, with pending agreements and memoranda of understanding now expected to take clearer shape this year after talks in Victoria between Bangladesh High Commissioner Dr Zokey Ahad and Seychelles Foreign Affairs and Diaspora Minister Barry Faure. The meeting, held on 21 May at Maison Quéau de Quinssy, centred on formalising cooperation frameworks that have been under discussion since Dr […]
Companies are pushing vulnerable software into production even as artificial intelligence expands the speed, volume and complexity of application development across global supply chains. New industry findings show 75% of organisations often or sometimes deploy code they already know contains security weaknesses, underscoring a persistent gap between software delivery targets and risk controls. The figure marks only a limited improvement from last year’s 81%, suggesting that boards […]
A 2026 software supply chain security assessment shows that about 65 per cent of organisations in India cannot detect malicious packages, while 71 per cent do not use container security tools. The findings underline a widening gap between the speed of AI-led software development and the controls needed to secure code, dependencies, models and deployment pipelines before they reach production systems.
Security teams are facing a more complex threat environment as AI coding assistants, model registries, agent frameworks and machine-learning libraries become embedded in day-to-day software engineering. AI is no longer confined to application features or analytics layers. It is becoming part of the software supply chain itself, influencing how code is written, tested, packaged and deployed.
Enterprises in India have been quick to adopt AI tools to improve developer productivity, reduce repetitive work and accelerate product releases. Yet the same shift has increased reliance on open-source packages, pre-trained models, plug-ins and automated build systems. Each of these components can introduce hidden risks if provenance, integrity and behaviour are not continuously verified.
Global software repositories are now attracting sustained attacks because they provide a direct route into enterprise development environments. Malicious npm packages rose by 451 per cent during 2025, while more than 48,000 new Common Vulnerabilities and Exposures were disclosed worldwide, a rise of about 20 per cent from the previous year.
The pressure on security teams is being amplified by the volume of AI-generated code. Developers in India are spending about 51 per cent of their time reviewing, validating and hardening code produced by AI tools. About 53 per cent treat such output only as a starting point and review every line before use, while 11 per cent rewrite AI-generated fixes from scratch.
This shift has altered the economics of software engineering. AI may reduce the time needed to draft code, but it can also transfer effort to verification, testing and security review. Weaknesses such as cross-site scripting, SQL injection and missing authorisation checks can still be reproduced by automated tools, particularly when developers rely on generated code without adequate scrutiny.
Governance is emerging as another area of concern. Nearly 97 per cent of organisations surveyed said they had certified AI model governance programmes, but only 59 per cent claimed full provenance visibility across production environments. About 48 per cent still needed a week or longer to produce audit-ready compliance evidence.
That gap points to a difference between policy and enforceable control. Many enterprises have AI governance frameworks on paper, but fewer can prove where every model, library, container image and software artefact came from, how it changed, who approved it and whether it complies with internal policy.
CERT-In has also warned that software supply chain compromises are increasingly targeting developer tools and trusted repositories. Its April 2026 activity note referred to attacks affecting npm, PyPI, GitHub Actions and container registries, including incidents involving Checkmarx, Trivy, LiteLLM, Axios, Telnyx and npm packages linked to the CanisterWorm campaign. The payloads observed in these attacks included credential harvesting, data exfiltration, remote execution and persistence within developer systems.
Model registries have added another layer to the risk. Around 1.4 million new AI artefacts were published on Hugging Face during 2025, representing 58 per cent of all new software packages tracked in one assessment. Researchers identified 495 malicious AI models in public repositories with active payloads capable of credential theft, command execution and reverse-shell activity, along with 969 malicious AI-agent skills designed to exploit developer environments and automation workflows.
For enterprises in India, the challenge is sharpened by the country’s role as a major software engineering and global capability centre hub. Bengaluru, Hyderabad, Pune, Chennai and Gurugram host large engineering teams serving banking, retail, telecoms, manufacturing and cloud services. These centres are increasingly responsible not only for maintenance work but also for product development, AI integration and security-sensitive digital platforms.
Regulatory and customer expectations are also tightening. Buyers are asking for software bills of materials, vulnerability disclosure processes, provenance records and proof that build pipelines are protected. CERT-In’s technical guidance on SBOM, QBOM, CBOM, AIBOM and HBOM has emphasised regular updates, vulnerability exploitability exchange documents and staff training around software supply chain visibility.
Security leaders are therefore moving towards stronger controls across development pipelines. These include automated malicious package detection, container image scanning, secrets detection, signed artefacts, dependency pinning, model provenance checks, policy enforcement in CI/CD systems and continuous monitoring of developer environments.
The investment case is becoming harder to ignore. Software supply chain attacks can bypass perimeter defences because they enter through trusted development channels. Once inside, malicious packages can steal credentials, alter builds, move into cloud environments or compromise downstream customers. AI raises the stakes because it can accelerate both legitimate development and attacker experimentation.
Cybercriminals are expanding phishing infrastructure built around the 2026 FIFA World Cup, with threat researchers mapping 222 malicious or suspicious domains to 203 unique IP addresses as fraud campaigns target fans, sponsors, travel operators and online shoppers before the tournament opens on 11 June. The findings point to a much broader operation than the first wave of 79 lookalike domains that impersonated FIFA and ticketing-related services. The […]
Russian state-backed cyber groups are broadening their entry points into targeted networks, using remote access services, stolen credentials, compromised suppliers and tailored social engineering to penetrate government, critical infrastructure and commercial systems. The pattern marks a shift from single-vector intrusions towards layered access operations designed to look like ordinary business activity. Remote Desktop Protocol, virtual private network accounts, cloud identities, internet-facing routers, edge devices and third-party service […]
Apache OFBiz users have been urged to move to version 24.09.06 after disclosure of an authentication bypass flaw that can be chained to remote code execution, exposing enterprise resource planning systems to takeover through a manipulated password-change workflow. Tracked as CVE-2026-45434, the vulnerability affects Apache OFBiz versions before 24.09.06. It stems from improper authentication handling in the platform’s password-change logic, where a forced password reset condition may […]
Cisco has issued an urgent security fix for a maximum-severity flaw in Secure Workload that could let unauthenticated attackers obtain Site Admin privileges and reach sensitive enterprise resources through internal REST API endpoints. The vulnerability, tracked as CVE-2026-20223, has been assigned a CVSS v3.1 base score of 10.0, the highest rating under the widely used severity system. It is classified as CWE-306, or missing authentication for a […]
GitHub has confirmed unauthorised access to about 3,800 internal repositories after an employee device was compromised through a poisoned Visual Studio Code extension, raising fresh concerns over the security of developer tools and software supply chains. The Microsoft-owned platform said it detected and contained the compromise on May 19, removed the malicious extension version, isolated the affected endpoint and began incident response measures. Its assessment so far […]
Millions of browser users have been targeted by CypherLoc, a scareware campaign built to freeze screens, mimic security alerts and push victims towards fraudulent technology support operators. Security researchers tracking the activity said about 2.8 million attacks have been observed since the start of 2026, underscoring the scale of a threat that relies less on advanced malware and more on pressure, confusion and trust in familiar security […]
Microsoft has disrupted infrastructure used by Fox Tempest, a cybercrime-enabling group accused of selling fraudulent code-signing services that helped ransomware operators disguise malware as trusted software. The action, led by Microsoft’s Digital Crimes Unit, targeted a malware-signing-as-a-service operation that allegedly abused legitimate software verification systems, including Microsoft’s Artifact Signing platform. A legal case unsealed in the US District Court for the Southern District of New York said […]
Hackers stole parts of Grafana Labs’ codebase after gaining access to its GitHub environment through a compromised token, prompting fresh concern over software supply-chain security at a company whose observability tools are embedded across enterprise technology operations. The New York-based open source software developer said an unauthorised party accessed its GitHub environment and downloaded code after obtaining a token with repository access. The attackers then tried to […]
Multiple high-severity vulnerabilities in SEPPmail Secure E-Mail Gateway have exposed organisations using the encrypted messaging appliance to risks ranging from remote code execution to interception of confidential email traffic, with the highest concern centred on publicly reachable systems in Germany, Austria and Switzerland. The flaws affect a product widely used to secure email exchange between companies and external recipients, particularly where encrypted messages, large file transfers and […]
A fast-moving supply-chain attack has hit a broad set of npm packages linked to the @antv ecosystem, exposing developers and organisations to credential theft through malicious package versions tied to the maintainer account “atool”. The campaign, identified on May 19, 2026, appears to form part of the Mini Shai-Hulud malware wave, a self-spreading operation that has already affected other developer ecosystems through compromised open-source packages. The latest […]
Authorities across the Middle East and North Africa have arrested 201 people in a coordinated cybercrime sweep that targeted phishing, malware and online financial fraud networks operating across 13 jurisdictions. Operation Ramz, coordinated by Interpol from October 2025 to 28 February 2026, also identified 382 further suspects and 3,867 victims, marking the first cyber operation of this scale led by the international police body across the MENA […]
Paper Werewolf has expanded its campaign against Russian industrial, financial and transport organisations, using phishing emails, fake Adobe software updates and the EchoGather remote access trojan to deepen access inside targeted networks. The Russian-language threat cluster, also tracked as GOFFEE, was active in the March-April 2026 window with a toolset that shows a clear shift from conventional phishing toward layered intrusion chains. The latest campaign begins with […]
Critical security flaws in n8n have exposed how quickly workflow automation platforms can become high-value targets when they connect business systems, credentials, data stores and artificial intelligence tools inside one operating layer. The vulnerabilities affect n8n versions before 1.123.43, 2.20.7 and 2.22.1, with security advisories warning that attackers with workflow creation or modification rights could combine weaknesses to achieve remote code execution on affected servers. The most […]
Arabian Post Staff -Dubai Manama has gained another marker in its shift towards cash-light commerce as stc Bahrain became the first telecommunications provider in the kingdom to introduce Mastercard’s Click to Pay, adding a faster checkout option for customers making digital payments. The launch places the telecom operator deeper into Bahrain’s expanding financial technology ecosystem, where mobile wallets, instant transfers and tokenised card payments are becoming part […]
Malta has struck a landmark agreement with OpenAI to provide ChatGPT Plus access across the country, making it the first government-backed national rollout of the paid artificial intelligence service tied to a public AI literacy programme. The partnership, announced on 16 May 2026, will allow eligible Maltese citizens to use ChatGPT Plus at no personal cost for one year after completing a free course on artificial intelligence. […]
Floci has crossed 10,000 GitHub stars as software teams look for a free, no-account alternative to LocalStack for local AWS emulation after a licensing and distribution change disrupted established development workflows. The milestone, reached on May 15, 2026, marks a sharp rise for the MIT-licensed project, which presents itself as a drop-in replacement for LocalStack’s former community edition. The shift has drawn attention from developers running automated […]
Two vulnerabilities in the Avada Builder plugin have exposed around one million WordPress websites to attacks that could reveal sensitive files or extract database information, prompting urgent calls for administrators to update to the fully patched version 3.15.3. The flaws affect Avada Builder, also known as Fusion Builder, a widely used page-building plugin bundled with the Avada WordPress theme. The higher-rated issue, tracked as CVE-2026-4798, is an […]
Security teams are racing to contain a high-severity PraisonAI flaw after exploitation attempts were detected within hours of public disclosure, underscoring how quickly attackers are probing exposed artificial intelligence infrastructure. The vulnerability, tracked as CVE-2026-44338, affects PraisonAI versions from 2.5.6 to before 4.6.34. It stems from a legacy Flask API server shipped with authentication disabled by default. Where that server is reachable over a network, any unauthorised […]
A critical flaw in the Burst Statistics WordPress plugin has put more than 200,000 websites at risk of unauthorised administrator access, intensifying concern over the security of third-party tools used across the world’s most popular content management system. The vulnerability, tracked as CVE-2026-8181, affects Burst Statistics versions 3.4.0 through 3.4.1.1 and carries a CVSS severity score of 9.8, placing it in the critical category. A patched version, […]
Global companies are moving AI agents into sensitive cyber security workflows faster than many can secure them, raising fresh concerns over identity systems, privileged access and recovery readiness after a breach. A global survey of 1,100 organisations across the US, UK, France, Germany, Italy, Spain, Australia and Singapore found that 93% either already use or plan to use AI agents for security tasks such as password resets […]
