Security

Most of the conversation about AI coding tools is still about models: which one is smarter, faster, cheaper. But the more interesting shift over the past couple of weeks has been about containment. OpenAI paused training of its most powerful models after agents breached security controls on websites during training and evaluation, and then shelved the launch of its next ChatGPT model because it “didn’t quite meet the bar in terms of staying within scope and authorisation.” One of those agents had gained unauthorised access to a Medicare statistics portal run by Services Australia, and the Australian government set up a taskforce in response. Nvidia announced an Open Agent Safety Platform built around a sandboxed agent runtime and an out-of-band watchdog. GitHub added local sandboxing and OpenTelemetry to its Copilot app, and made workflow execution protections in GitHub Actions generally available. ...

For years, frontend engineering had a comforting boundary. The backend held the real power: databases, payments, authorization, infrastructure, production secrets. The frontend rendered the interface. It ran in the browser, where users could inspect it, modify it, and ultimately distrust it. That model still contains an important truth. The browser is not a trusted environment. A serious authorization decision cannot depend on what a client-side application chooses to show or hide. ...

If you fired up yay -Syu over the past week and noticed your AUR packages silently refusing to update, you’re not imagining it — and it isn’t a bug in your helper. As of August 1, 2026, Arch Linux disabled all pushes to the Arch User Repository, meaning maintainers could no longer publish updates, new versions, or fixes to the community package collection that most of us rely on daily. The AUR stayed up and readable, but writes were locked down while the project fought off its third supply-chain attack since June. ...

For years, the default Angular auth tutorial looked like this: call /login, get a JWT, stash it in localStorage, attach Authorization: Bearer … from an interceptor, and sprinkle a couple of route guards on top. It ships. It demos well. And it quietly trains teams to treat the browser as a safe place for long-lived credentials. It is not. In 2026 the guidance has converged, and it is blunt: Prefer OAuth 2.0 / OIDC with a reverse proxy or dedicated auth provider — not a hand-rolled password form that mints forever-tokens for the SPA. Prefer short-lived access tokens (and refresh handled outside the SPA) over long-lived credentials in the browser. Prefer HttpOnly, Secure, SameSite cookies over storing sensitive JWTs in localStorage or sessionStorage. This post is the practical shape of that advice for Angular apps: why localStorage JWTs lose to XSS, how a Backend-for-Frontend (BFF) or reverse-proxy session keeps tokens off the client, and what Angular still owns — interceptors, CSRF headers, and guards that improve UX without pretending to enforce authorization. ...

At first glance, a client-side JavaScript framework looks like “just” UI code. It runs in the browser, the browser already has security boundaries, and most of the app logic is yours. So what exactly is a “security update” for that framework supposed to fix? The answer is the same whether you use Angular, React, Vue, or anything else in the same role: the framework is not only application code — it is part of the security boundary. It parses templates or JSX, sanitizes HTML, protects against XSS and related request attacks, and in many apps also powers server-side rendering. If the framework makes a mistake in any of those layers, an attacker may be able to steal data, inject script, or break request isolation even though the code ultimately runs in a browser or helps render content for one. ...

Progressive Web Apps sell reliability: installable shells, offline reads, background sync when the network returns. Angular’s @angular/service-worker makes that easy to turn on. Security does not get the same one-liner. A service worker sits between your app and the network with a long-lived cache — which means it can also sit between an attacker and your users’ private data if you treat “offline” as “store everything.” Industry checklists already call out HTTPS everywhere, including service worker scope, and auth guidance keeps warning against patterns that inflate XSS and CSRF risk when sessions go offline. This post is the Angular-shaped version: enforce TLS and a tight SW scope, cache only what is safe to replay, and keep offline UX without parking bearer tokens in IndexedDB. ...

Angular apps are rarely “just Angular.” They sit on the CLI, a pile of third-party libraries, often Nx or another monorepo tool, and a lockfile that quietly doubles every quarter. That surface is where a lot of real risk lives: not in your component tree, but in a transitive package nobody reviewed last sprint. Best-practice write-ups keep repeating the same triad — scan regularly, automate checks in CI, and treat framework updates as security work. The missing piece for many teams is turning that advice into a pipeline that generates an SBOM, fails on high-severity CVEs, and tells humans when something broke — without waiting for someone to remember npm audit on Friday. ...

Angular already sanitizes template bindings. That is necessary and still not enough. XSS keeps showing up through supply-chain scripts, sanitizer edge cases, and the occasional bypassSecurityTrustHtml that “was only temporary.” Content Security Policy is the browser-level seatbelt: even if a payload reaches the DOM, the browser refuses to execute script the policy does not allow. CSP is repeatedly listed as a must-have for Angular apps. Many write-ups still skip the Angular-specific parts: dynamic styles the runtime injects, critical CSS inlining, autoCsp / ngCspNonce / CSP_NONCE, and the temptation to “just add unsafe-inline and unsafe-eval so the build works.” ...

In today’s digital age, the security of web applications is of paramount importance. With cyber-attacks becoming increasingly sophisticated, web developers must implement robust security measures to protect their applications and users. This blog post explores three advanced security practices—Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), and Subresource Integrity (SRI)—that can significantly enhance the security of web applications. We will delve into their implementation, use cases, and benefits, providing comprehensive guidance to help you secure your web applications effectively. ...

Doctor Web has discovered a malicious Linux program that hacks websites based on a WordPress CMS. It exploits 30 vulnerabilities in a number of plugins and themes for this platform. If sites use outdated versions of such add-ons, lacking crucial fixes, the targeted webpages are injected with malicious JavaScripts. As a result, when users click on any area of an attacked page, they are redirected to other sites. What they can do? Upon their command, it is able to perform the following actions: ...

Starting today, January 10th, Windows 7 Enterprise and Professional operating systems will no longer receive security updates. Thus, computers that still run these OS will no longer be protected against critical vulnerabilities. Apart from the operating system itself, browsers (both Edge and third-party browsers), as well as services from other non-Microsoft vendors, such as NVIDIA, have confirmed that they have also stopped offering new security patches in Windows 7. Actions to be taken You should upgrade your Microsoft Windows to newer versions, if your hardware does not support Windows 11, you may upgrade to Windows 10 or maybe consider switching to another Operation System like Linux.

You’ve heard it again and again: You need to use a password manager to generate strong, unique passwords and keep track of them for you. And if you finally took the plunge with a free and mainstream option, particularly during the 2010s, it was probably LastPass. For the security service’s 25.6 million users, though, the company made a worrying announcement last week: A security incident the firm previously reported on November 30 was actually a massive and concerning data breach that exposed encrypted password vaults—the crown jewels of any password manager—along with other user data. ...

Microsoft researchers found a cross-platform botnet that originates from malicious software downloads on Windows devices & succeeds in propagating to a variety of Linux-based devices by enumerating default credentials on internet-exposed SSH-enabled devices. Microsoft researchers observed that the initial infection points related to the botnet were devices infected through the installation of malicious cracking tools that purport to acquire illegal Windows licenses. The cracking tools contain additional code that downloads and launches a fake version of svchost.exe through a PowerShell command. In some cases, the downloaded file is named svchosts.exe. ...

The Intel Security Advanced Threat Research Team has discovered a critical signature forgery vulnerability in the Mozilla Network Security Services (NSS) crypto library that could allow malicious parties to set up fraudulent sites masquerading as legitimate businesses and other organizations. The Mozilla NSS library, commonly utilized in the Firefox web browser, can also be found in Thunderbird, Seamonkey, and other Mozilla products. Dubbed “BERserk”, this vulnerability allows for attackers to forge RSA signatures, thereby allowing for the bypass of authentication to websites utilizing SSL/TLS. Given that certificates can be forged for any domain, this issue raises serious concerns around integrity and confidentiality as we traverse what we perceive to be secure websites. ...