InfoQ - Application Security - News

GitHub Expands Secret Scanning with General Availability of MCP Server Integration

Craig Risi — Tue, 12 May 2026 12:00:00 GMT

GitHub has announced the general availability of secret scanning support through its MCP Server, extending automated credential detection and remediation capabilities into AI-assisted and agent-driven development workflows.

By Craig Risi

Attacker Bought 30 WordPress Plugins on Flippa and Backdoored All of Them

Steef-Jan Wiggers — Wed, 06 May 2026 10:00:00 GMT

An attacker purchased 30+ WordPress plugins on Flippa for six figures, planted a PHP deserialization backdoor in the first commit, and waited eight months before activating it across 400,000 installations. The attack used Ethereum smart contracts to resolve C2. WordPress.org has no mechanism for reviewing plugin ownership transfers, a gap that npm and PyPI addressed years ago.

By Steef-Jan Wiggers

GitHub Enhances CodeQL with Declarative Security Modeling for Faster, More Flexible Analysis

Craig Risi — Tue, 05 May 2026 12:00:00 GMT

GitHub has introduced a significant update to its CodeQL engine, enabling developers to define custom sanitizers and validators directly through "models-as-data," a move that simplifies how teams extend security analysis across their codebases.

By Craig Risi