#WhatsApp: A US agent claimed WhatsApp encryption is fake and Meta can access messages; the probe was abruptly shut, raising security concerns. The investigation’s closure leaves key questions unanswered, including what evidence was found:

https://securityaffairs.com/191515/social-networks/agents-claims-on-whatsapp-access-spark-security-concerns.html

#PyPI: PyTorch Lightning and Intercom-client Packages Hit in Supply Chain Attacks to Steal Credentials.

This attack is linked with Mini Shai-Hulud supply chain attack that targeted SAP-related npm packages on Wednesday.

#SoftwareSupplyChainSecurity
👇
https://thehackernews.com/2026/04/pytorch-lightning-compromised-in-pypi.html

⚠️ #Linux: Major Linux distributions are impacted by a Privilege Escalation Vulnerability dubbed "CopyFail" (CVE-2026-31431) which sat undetected since 2017.
A 732-byte Python script allows any user on Linux to become root:
#CopyFail
#LPE
👇
https://www.cyberkendra.com/2026/04/a-732-byte-python-script-can-get-root.html

#npm: Multiple official SAP npm packages were compromised in what is believed to be a TeamPCP supply-chain attack to steal credentials and authentication tokens:
#SoftwareSupplyChainSecurity
👇
https://www.bleepingcomputer.com/news/security/official-sap-npm-packages-compromised-to-steal-credentials/

#SMS: Canadian authorities have arrested three men for operating an "SMS blaster" device that pretends to be a cellular tower to send phishing texts directly to nearby phones. SMS should always be treated as an insecure channel:
👇
https://www.bleepingcomputer.com/news/security/canada-arrests-three-for-operating-sms-blaster-device-in-toronto

Everyone’s vibe coding now. But is the produced code actually secure?

Jim Manico's excellent talk shows the better path: don’t just ask #ClaudeCode to write code.

Engineer with AI.

Practical, direct, and highly relevant for anyone building with AI.

Watch it here:
👇
https://youtu.be/thsdAsgIsFc

#Passwords: NCSC: Leave passwords in the past - passkeys are the future!

UK's National Cyber Security Centre releases guidance - Passwords are no longer resilient enough for the contemporary world. It's time to switch to passkey authenticaton:
👇
https://www.ncsc.gov.uk/news/ncsc-leave-passwords-in-the-past-passkeys-are-the-future

#Bitwarden CLI was compromised in a supply chain attack!

@bitwarden/[email protected] included malicious code:

#SoftwareSupplyChainSecurity
👇
https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html

#NPM: Self-Propagating Supply Chain Malware Hijacks npm Packages to Steal Developer Tokens.
Impacted packages:

@automagik/genie
@fairwords/loopback-connector-es
@fairwords/websocket
@openwebconcept/theme-owc
pgserve

also Python xinference compromised:

https://thehackernews.com/2026/04/self-propagating-supply-chain-worm.html

⚠️ #Vercel hacked.
The popular platform behind tens of thousands of AI apps and the creator of NextJS framework has confirmed a breach. Hackers claiming to be ShinyHunters are selling stolen customer + employee data:
#databreach
👇

https://www.bleepingcomputer.com/news/security/vercel-confirms-breach-as-hackers-claim-to-be-selling-stolen-data/

Want to present a talk at the #OWASP Global #AppSec Conference 2026 in San Francisco in November?
Call For Papers is now open
👇

#Nginx: A critical vulnerability CVE-2026-33032 in Nginx UI with Model Context Protocol (#MCP) support is now being exploited in the wild for full server takeover without authentication.
👇
https://www.bleepingcomputer.com/news/security/critical-nginx-ui-auth-bypass-flaw-now-actively-exploited-in-the-wild/