Aikido Security's Blog https://www.aikido.dev Discover today's best security practices and the latest trends that your software company should be aware of. Stay ahead of the game and read Aikido's industry-leading blog today. Wed, 21 Oct 2026 15:36:08 GMT Webflow LiteLLM compromised again: infostealer and RAT found in version 1.107.0 https://www.aikido.dev/blog/litellm-compromised-infostealer-rat https://www.aikido.dev/blog/litellm-compromised-infostealer-rat Wed, 21 Oct 2026 13:05:00 GMT What you need to know about PHP2shell. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell Wed, 21 Oct 2026 01:54:00 GMT tensorlake NPM package compromised with Shai Hulud worm https://www.aikido.dev/blog/tensorlake-npm-package-compromised https://www.aikido.dev/blog/tensorlake-npm-package-compromised Thu, 08 Oct 2026 03:32:00 GMT Novel supplychain.local Go worm appears https://www.aikido.dev/blog/supplychain-local-memtensor-npm-pypi https://www.aikido.dev/blog/supplychain-local-memtensor-npm-pypi Wed, 23 Sep 2026 07:41:00 GMT Graphalgo campaign spreads to Terraform providers and Go Modules https://www.aikido.dev/blog/graphalgo-terraform-go-modules https://www.aikido.dev/blog/graphalgo-terraform-go-modules Tue, 22 Sep 2026 12:18:00 GMT Compromised Flutter package on pub.dev contains XCSSET malware https://www.aikido.dev/blog/compromised-flutter-package-on-pub-dev-contains-xcsset-malware https://www.aikido.dev/blog/compromised-flutter-package-on-pub-dev-contains-xcsset-malware Tue, 08 Sep 2026 16:12:00 GMT Shai-Hulud Rises From the Dead after 111 days https://www.aikido.dev/blog/shai-hulud-npm-resurfaces https://www.aikido.dev/blog/shai-hulud-npm-resurfaces Mon, 07 Sep 2026 11:55:00 GMT StyleSmuggler fix: patch the Magento and Adobe Commerce RCE https://www.aikido.dev/blog/stylesmuggler-fix https://www.aikido.dev/blog/stylesmuggler-fix Mon, 07 Sep 2026 11:46:00 GMT MECCHA CHAMELEON can't hide from the RCE https://www.aikido.dev/blog/meccha-chameleon-rce https://www.aikido.dev/blog/meccha-chameleon-rce Thu, 03 Sep 2026 18:00:00 GMT Popular code generator for TanStack Query hit by supply chain worm https://www.aikido.dev/blog/popular-code-generator-for-tanstack-query-hit-by-supply-chain-worm https://www.aikido.dev/blog/popular-code-generator-for-tanstack-query-hit-by-supply-chain-worm Fri, 28 Aug 2026 21:25:00 GMT Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack https://www.aikido.dev/blog/two-popular-rust-crates-arrayref-and-append-only-vec-compromised-in-supply-chain-attack https://www.aikido.dev/blog/two-popular-rust-crates-arrayref-and-append-only-vec-compromised-in-supply-chain-attack Thu, 20 Aug 2026 11:30:00 GMT Yet another RCE in Gogs, but it's fixed this time! https://www.aikido.dev/blog/fixed-rce-gogs-cve-2026-52813 https://www.aikido.dev/blog/fixed-rce-gogs-cve-2026-52813 Wed, 19 Aug 2026 12:08:00 GMT Keyv and friends compromised in active Shai-Hulud supply chain attack https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack Tue, 04 Aug 2026 10:37:00 GMT Anthropic's Fever Dream: Claude's package that stole real keys https://www.aikido.dev/blog/anthropic-rogue-agents-package-stole-keys https://www.aikido.dev/blog/anthropic-rogue-agents-package-stole-keys Fri, 31 Jul 2026 16:10:00 GMT Finding eight high-severity vulnerabilities in NodeBB in six hours https://www.aikido.dev/blog/eight-high-severity-vulnerabilities-nodebb https://www.aikido.dev/blog/eight-high-severity-vulnerabilities-nodebb Wed, 22 Jul 2026 21:44:00 GMT SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts https://www.aikido.dev/blog/sleepergem-rubygems-supply-chain-attack https://www.aikido.dev/blog/sleepergem-rubygems-supply-chain-attack Sun, 19 Jul 2026 08:45:00 GMT Unauthenticated RCE in WordPress core (wp2shell), via SQL injection https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell Fri, 17 Jul 2026 21:19:00 GMT AsyncAPI npm packages backdoored via GitHub Actions https://www.aikido.dev/blog/asyncapi-npm-packages-backdoored-via-github-actions https://www.aikido.dev/blog/asyncapi-npm-packages-backdoored-via-github-actions Tue, 14 Jul 2026 10:00:00 GMT Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry https://www.aikido.dev/blog/compromised-injectivelabs-exfiltrates-keys https://www.aikido.dev/blog/compromised-injectivelabs-exfiltrates-keys Thu, 09 Jul 2026 15:26:00 GMT