company
ReversingLabs is a cybersecurity company that provides malware analysis and threat intelligence to detect malicious or tampered software packages.
No evidence-backed relationships are recorded.
Ridge Security's 96-test pen-test benchmark had Claude Opus 4.6 reach 63% coverage at $217 a run, against 52% for Gemini 3 Flash at about $5.42. Ridge argues tooling matters more than the model, yet its published runs held the tooling fixed and varied the model.
Reality
Two TeamPCP-linked actors are under arrest after package compromises that ReversingLabs says caused a suspected hundreds of millions of dollars in damages. The waves since September 2025 began with a stolen publishing credential and reached victims through updates their own pipelines installed.
Reality
Chainguard disclosed 14 Java vulnerabilities that were fixed upstream but never assigned a CVE, one rated critical and one high. Teams still on the affected versions got no scanner alert, some for years, because nobody announced the fixes when they landed at HEAD.
Reality
Cisco Talos says a Chinese-speaking crew paired PentestGPT and DeepAudit with Metasploit and a 170,000-URL target list to compromise web servers at scale. Every entry flaw named is years old.
Reality
Two men arrested in Australia this week are alleged TeamPCP members. The AFP estimate filed alongside the case puts the worm's take at more than 500,000 credentials and 300GB of data, and that scale makes token lifetime the live question.
Perspective Coverage
17 publishersReality
Aikido found the Graphalgo implant inside two Terraform providers and two Go modules. The Go build polls a hard-coded testnet contract every three seconds and keeps a Slack bot channel open as its second route.
Reality
Aikido found the Graphalgo campaign's Go port inside two Terraform providers, one of them a typosquat of kreuzwerker/docker. The payload decrypts only when containerName and networkID hash to a hardcoded SHA256.
Reality
An IANS and Artico survey puts AI at about 3 percent of the average security budget, and 24 percent of organizations have given it a line of its own. Bugcrowd's CEO says the rest comes out of what was already bought.
Reality
ReversingLabs found tw-pkgprobe-7731 claiming to be an authorized Twilio HackerOne research probe while it tried to exfiltrate data, and its 2026 count of malicious npm packages passed all of 2024 by the end of August.
Reality
Chris Romeo says he cannot start a Claude sub-agent with a permission set narrower than its parent's. Jacob Krell says each delegation step creates an identity that IAM systems were never built to track.
Reality
A year on from the CISA and NSA memory-safety report, the adoption evidence is still provider roadmaps and practitioner judgement about C and C++ code that nobody proposes to rewrite wholesale.
Reality
A dev.to survey walks seven AI supply chain entry points and the named incidents behind each. The two dataset-poisoning numbers in it are the ones that should change how a model review is scoped.
Reality
The industry is still shipping the defect classes CISA has flagged for years. The case that AI coding assistants will multiply them comes from two named practitioners, not from the agency's own data.
Reality
Rubrik's Threat Monitoring and Threat Hunting now match backup snapshots against ReversingLabs' ransomware feed, aimed at catching a dormant payload before an operator restores it and at dating the last clean snapshot.
Reality
A genuine Carnival booking confirmation passed SPF, DKIM and DMARC and pointed at a promotional domain the company had let lapse. Someone re-registered it, wired it into a cloaking network, and the link kept routing for 74 days.
Reality
Forcepoint X-Labs hid instructions in zero-pixel white HTML and watched a summarizer repeat them as fact. The measurement is new; two named practitioners say the design flaw it measures has been documented since 2023.
Reality
The chain in OpenAI's post-mortem on the Hugging Face incident runs through a RubyGems processing bug, an HDF5 dataset file and 14 write tokens that were already public, according to Pillar Security's Dor Sarig. OpenAI calls the result a warning shot.
Reality
Shai-Hulud is on its fourth iteration. Trivy, Axios and LiteLLM have all shipped compromised releases. ReversingLabs is giving away a plugin that checks every package request against a reputation index inside Artifactory itself.
Reality
An SC World commentary argues the AI security debate is stuck on model behavior while agent connectors get wired with API keys that never rotate and model loading still executes unsigned code.
Reality
ReversingLabs counted 397 ACRStealer samples against 26 for the freshly updated AuraStealer. In a rented-malware market, the newest family is not the busiest one.
Reality
Security · August 20, 2026 · 1 publisher
Build · August 14, 2026 · 1 publisher