InfoQ - Security Vulnerabilities

GitHub Introduces Default "Cooldown" Policy for Dependabot Version Updates

Sergio De Simone — Tue, 28 Jul 2026 19:00:00 GMT

Instead of immediately opening pull requests when newer dependency versions are released, Dependabot now waits three days before suggesting upgrades, thus increasing the likelihood that malicious releases are identified and removed before they can be integrated.

By Sergio De Simone

AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC

Olimpiu Pop — Sun, 26 Jul 2026 09:09:00 GMT

JFrog Security Research revealed "PixelSmash," a vulnerability in the FFmpeg media framework, allowing for Remote Code Execution and Denial of Service attacks. Present for sixteen years, it affects numerous applications using the MagicYUV decoder. Exploitation requires only a crafted media file. Users are advised to check for the vulnerability and apply patches or disable the decoder if necessary.

By Olimpiu Pop

Indirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data

Sergio De Simone — Thu, 23 Jul 2026 20:00:00 GMT

GitLost is a prompt-injection exploit discovered by Noma Security that tricks GitHub's new Agentic Workflows into leaking private data. By embedding concealed instructions within public GitHub issues, attackers can circumvent security safeguards and induce AI agents to reveal confidential information in public comments.

By Sergio De Simone