I need to confess something. A few days ago whilst vibe coding at 2am (which can end up burning through tokens like they are going out of fashion) I accidentally pasted my API key directly into a Claude chat instead of the terminal window I had open. Claude told me off. It felt like a full, proper, disappointed parent tone; the AI equivalent of 'I'm not angry, just disappointed', except it absolutely was angry. There may have been paragraphs.

The Trivy story is moving quickly, and the latest reporting makes one thing clear: this is no longer just a GitHub Actions tag hijack. What started as a compromise of trivy-action, setup-trivy, and the v0.69.4 release has expanded into malicious Docker Hub images.

If you operate a fundraising platform, process donations, or work with nonprofit organizations, you’re expected to verify that those organizations are legitimate before doing business with them. This process is known as nonprofit Know Your Business (KYB) or non-profit verification, which requires confirming 501(c)(3) status and ensuring the nonprofit is in good standing. But the verification process for nonprofit KYB isn’t as straightforward as it sounds.

On March 9th, Codewall.ai disclosed how it had hacked McKinsey & Company’s AI platform called Lilli, a purpose-built system for 43,000+ employees to analyze documents, chat, and access decades of proprietary research. The researchers unleashed an AI agent which quickly scanned 200 endpoints, identified 22 that did not require authentication, and one that wrote user search queries into a database including non-parameterized JSON keys which were concatenated directly into SQL.

BUFFALO, N.Y., March 24, 2026 — Sedara, a cybersecurity solutions provider specializing in Managed Detection and Response (MDR) and Attack Surface Management (ASM), today announced it has been named a Hot Company in Attack Surface Management in the 14th Annual Global InfoSec Awards, presented by Cyber Defense Magazine during RSAC 2026 Conference in San Francisco. The Global InfoSec Awards recognize cybersecurity innovators worldwide.