Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

mend

Mini Shai-Hulud hits openapi-react-query-codegen: 10 malicious npm versions

Aug 29, 2026 By Alina Podoba In Mend
On August 28, 2026, ten malicious versions of @7nohe/openapi-react-query-codegen were published to npm between 20:00 and 20:21 UTC. The package generates React Query hooks from an OpenAPI schema and draws roughly 150,000 weekly downloads. The latest tag pointed at the malicious 3.0.4 for the duration of the window. Eight of the ten releases carry a multi-stage loader that reaches for cloud, registry, and developer credentials. The attacker needed no stolen npm token and no hijacked maintainer account.
Read Post
mend

The skill layer is a dependency problem without a lockfile: what the OWASP Agentic Skills Top 10 gets right

Aug 26, 2026 By Asaf Saar In Mend
OWASP published version 1.0 of the Agentic Skills Top 10 on August 17, defining ten risk classes for the layer where agents find, load, and run reusable instructions and code. This standard arrived while the problem was still forming, mapping directly to AISVS, the Agentic Security Initiative Top 10, the MCP Top 10, ISO/IEC 42001, and the NIST AI RMF. It ships with working code for signing, sandboxing, and pinning.
Read Post
mend

OWASP LLM Top 10 2026: the model will be fooled, the question is what breaks

Aug 13, 2026 By Asaf Saar In Mend
The OWASP GenAI Security Project published the 2026 edition of its Top 10 for LLM Applications. Prompt Injection stayed at number one. Sensitive Information Disclosure stayed at number two. Read the headlines and you would conclude that not much moved. Something did move, and it is not in the rankings. The project leads open by telling you to stop trying to build a model that cannot be fooled, and to build the system around it so that when the model is fooled, nothing important breaks.
Read Post
mend

That's a wrap: Mend.io at Black Hat USA 2026

Aug 7, 2026 By Stephanie Broyles In Mend
Another Black Hat USA is in the books, and what a week it was. From a main stage keynote at the AI Summit to candid podcast conversations, a video interview with Cyber Defense Magazine, and a booth game that just wouldn’t quit, Mend.io showed up in Las Vegas ready to talk about the question every security leader is wrestling with right now: as AI reshapes both the software we ship and the systems we have to defend, who do we trust to verify that it’s safe?
Read Post
mend

Patch faster isn't the answer. Patch smarter is.

Aug 4, 2026 By Shannon Davis In Mend
The 30-day patch cycle is dead. Most security teams already know this. What they haven’t fully reckoned with is why it died, and what has to replace it. SC Media recently gathered a range of security leaders on exactly this shift, and the picture they described is stark. AI didn’t just add more vulnerabilities to the pile. It collapsed the time between disclosure and exploitation from weeks to hours.
Read Post
mend

Mini Shai-Hulud Hits keyv: Trojanized Release Exfiltrates CI Secrets via GitHub

Aug 4, 2026 By Alina Podoba In Mend
On August 4, 2026, a malicious version of keyv was published to npm as keyv@6.0.0, one of a number of npm packages affected across the Keyv and Cacheable ecosystem. The release follows the Mini Shai-Hulud pattern: a trojanized version of a heavily depended-on package, with an install-time hook that reaches cloud and CI credentials. It leaves the compiled library untouched and instead adds a preinstall hook and two files.
Read Post

Why Traditional SAST Fails on AI-Generated Code

Aug 3, 2026 By Mend In Mend
AI didn't just speed up software development, it changed what application security programs must defend. As AI coding assistants generate code at machine speed and developers integrate AI agents, models, and RAG pipelines into production, traditional scanners generate endless backlogs of unprioritized alerts.
View Video

AppSec: When Bandwidth Isn't the Bottleneck

Jul 31, 2026 By Mend In Mend
AppSec teams are frequently told that a lack of bandwidth is why vulnerability backlogs keep growing. In reality, the bottleneck is not team size, it is the lack of contextual prioritization and agentic triage. When traditional scanners hand security teams thousands of findings without reachability context, developer velocity stalls. In this webinar, Mend.io security experts unpack why bandwidth is not the real bottleneck in modern software security and show you how to streamline triage, automate remediation, and secure code at AI speed.
View Video
mend

Move faster than AI-driven risk: Inside Mend.io's latest AI application security update

Jul 28, 2026 By Asaf Saar In Mend
AI didn’t just change how fast you ship. It changed what your AI application security program has to protect. Two years ago, security teams protected code, open source, and containers. Today they also have to protect AI agents, MCP servers, models, prompts, and runtime interactions, configured or deployed faster than any team can manually review. The attack surface didn’t grow. It exploded.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.