Every campaign has a story behind it. Ours happens to be a bedtime story. Read it to your kids. Read it to a little one in your life. Read it by yourself with a cup of coffee when you just "need a ...

Cursor with Gemini 4 Argon matches Fable 5 at 29% SecPass — tying for the top security score on Cursor — and uniquely solves two tasks no other combo on the leaderboard secures. But it is also the ...

By default, Endor Labs AI SAST and AI Chat send model requests to our provider accounts. With BYOK, those model requests go ...

Your developers asked an AI assistant for code this morning, and it shipped by lunch. AI security is the practice of protecting AI systems, using AI to defend other systems, and securing the code AI ...

We're excited to announce a technology partnership between Endor Labs and Bright Security, bringing together reachability-backed static analysis and AI-validated dynamic testing & validated ...

What Are the Executive Order 14028 SBOM Requirements in 2026? In January 2026, OMB dropped the federal attestation mandate. The SBOM requirement survived. Executive Order 14028 directed federal ...

The popular Tensorlake SDK, a package with more than 12,000 weekly downloads and 1000 GitHub starts shipped a poisoned release (version 0.5.144 ) that was infected with the self-propagating Shai-Hulud ...

I found a flaw in brig where an agent inside the sandbox plants a symlink resulting in an arbitrary host directory with read-write abilities in and out of the sandbox. Tracked as GHSA-wp6x-29qx-fpr7 ...

Imagine hiring a brilliant security engineer. They’re fast, capable, and eager to help. On day one, you give them access to your source code, GitHub, application security platform, and communication ...

Most security teams have a process for securing open source dependencies. Packages get pinned, scanned in CI, and checked against policy before they ship. VS Code extensions skip all of that. A ...

A compromised release of @7nohe/openapi-react-query-codegen runs a dropper on install through three separate triggers, then harvests cloud credentials and republishes itself across npm, RubyGems, and ...