A deep dive into “Clinejection”, where an attacker injected a prompt into a GitHub issue title, which an AI triage bot interpreted as an instruction. The resulting chain led to cache poisoning, credential theft, and a compromised npm package that silently installed a second AI agent on 4,000 developer machines.
PHP
Composer 2.11
Composer 2.11 adds a cooldown dependency policy that withholds newly published package versions for a configurable period. The release also includes several security fixes and faster dependency resolution. Read more