A PNG hiding a prompt injection could steal your repo's secrets, researchers demonstrate. The technique, dubbed 'Ghostcommit,' slipped past AI code reviewers CodeRabbit and Bugbot, which never open image files at all, then convinced a coding agent to read a repo's .env and write every secret into the code as a list of numbers. [...]

https://www.bleepingcomputer.com/news/security/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets/

Sat, 07/11/2026 - 09:03

CVE-2026-1359 | Genolve Plugin up to 5.0.5 on WordPress Capability Check genolve_setOpt improper authorization (EUVD-2026-43166)

A vulnerability marked as critical has been reported in Genolve Plugin up to 5.0.5 on WordPress. Affected by this vulnerability is the function genolve_setOpt of the component Capability Check. This manipulation causes improper authorization. This vulnerability appears as CVE-2026-1359. The attack may be initiated remotely. There is no available exploit.

https://vuldb.com/vuln/377774

Sat, 07/11/2026 - 09:00

MapToPoster JS – 低调又有范儿的地图海报

Home在线应用在线应用

https://buaq.net/go-428290.html

Sat, 07/11/2026 - 08:47

Posts of last 24 hours

Managed ad