Taiwanese vendor QNAP urges users to update Plex Media Server after reports of NAS compromises through the Plex2Shell vulnerability chain. QNAP urges users to update Plex Media Server through the QNAP App Center after reports that threat actors exploited the Plex2Shell vulnerability chain to compromise NAS devices. “QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through these vulnerabilities, and QNAP Technical Support is assisting the affected usersadvisory published by QNAP. ” reads the report published by the vendor. “The QNAP Product Security Incident Response Team (QNAP PSIRT) has confirmed that the vulnerabilities exist only in Plex Media Server; QTS, QuTS hero, and other QNAP operating systems are not themselves affected.” Plex Media Server is designed to make movies, music, and other media available across devices. But when a server is exposed to the internet and runs vulnerable software, it can become an entry point for attackers who have little interest in your film collection. On October 16, 2026, security researcher Zach Main published technical details and proof-of-concept (PoC) code for a vulnerability chain dubbed Plex2Shell. Within a day, researchers had observed attackers using the exploit against an internet-facing honeypot, deploying cryptocurrency-mining malware and proxy software. The incident is a reminder of how quickly a public exploit can be weaponized by threat actors. The chain combines four vulnerabilities in Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Together, they can allow attackers to execute arbitrary code on vulnerable servers without valid credentials, provided the required conditions are met. The code runs with the privileges of the Plex service, giving attackers an opportunity to install additional software and abuse the host. The technical details are available in Main’s original analysis, Plex2Shell. Plex had been notified of the vulnerabilities on July 27 and acknowledged the report on August 4, awarding a bug bounty. The company released fixes in September, before the exploit code became public. The loader does not check the library’s name, executable permissions, digital signature, or symbols. As a result, the library’s ELF constructor can run with the same privileges as the Plex service. “It doesn’t check for a lib prefix, doesn’t require the execute bit, doesn’t verify any signature, and doesn’t look for any specific symbol.” reads the report published by zmain.com. “When dlopen loads a shared object, it runs the ELF’s DT_INIT_ARRAY (constructor functions) before doing any symbol resolution. A .so that only has a constructor and no exported symbols will still execute its code on load. We then trigger a second transcode. The codec directory gets re-enumerated, the .so we wrote in Stage 4 gets loaded, and the constructor runs as uid=1000(plex).” That detail matters because the final stage can exploit how Plex loads shared libraries. The chain uses a setting related to transcoding to influence execution, allowing a specially crafted library to run when Plex loads it. The result can be code execution under the service account, without requiring the attacker to obtain an interactive login first. QNAP urges users to update Plex Media Server immediately, users should go to App Center, open My Apps and update Plex Media Server to version 1.43.3 or later. They should then check in Plex Web, under Settings and General, that the installed version is 1.43.3.10861 or later. QNAP will release further updates after verifying them, but users should not wait. If Plex was reachable from the internet while running version 1.43.2 or earlier, users should treat the NAS as potentially compromised. This may apply if Plex Remote Access was enabled, port 32400 was forwarded, or the port was opened automatically through UPnP or router settings. Updating alone will not remove anything an attacker may have installed. In those cases, users should follow QNAP’s FAQ to perform a clean reinstall, check for signs of compromise and reset both their Plex and NAS credentials. The company also advises disabling Plex Remote Access if it is not needed and avoiding port forwarding for port 32400. Users who need remote access should use a VPN instead. QNAP also recommends keeping QTS or QuTS hero and all installed apps up to date. Step-by-step instructions are available in the Plex2Shell: Check and Remediation FAQ for QNAP NAS Users. CISA added Plex2Shell flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026, urging federal agencies to addresse them by October 23, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, QNAP)
The US Department of the Treasury has cut off the MEXC Global crypto exchange from the US financial system over sanctions evasion and links with cybercrime gangs. Founded in 2018, the Seychelles-based MEXC is one of the world's largest crypto exchanges, giving more than 40 million users from more than 170 countries access to 3,000 cryptocurrencies and tokenized assets. According to a Financial Crimes Enforcement Network (FinCEN) order, MEXC has allowed illicit transactions of at least $16 billion linked to cybercrime operations and Iranian, North Korean, and Russian sanctions evasion between May 2021 and May 2026. The Treasury Department said that, as recently as June 2026, MEXC was still processing transactions with sanctioned Russian entities Garantex and Grinex, and it also facilitated or processed at least $226 million in transactions benefiting or connected to the Russia-based, OFAC-sanctioned A7 sanctions evasion network.
Ukrainian law enforcement arrested four suspects in a case involving the theft of more than €4.3 million using a network of cryptocurrency investment scam call centers. In these fraud schemes (also known as romance baiting or pig butchering scams), criminals lure targets through social media, dating sites, and messaging apps into fake investment schemes, stealing their money instead of investing the funds as promised. The investigation involved Ukraine's Cyber Police Department, the Main Investigation Department of the National Police of Ukraine, and German law enforcement authorities. According to Ukraine's Cyber Police, the suspects used phone calls and messaging apps to build victims' trust through social engineering and trick them into investing in cryptocurrency, shares, and other financial instruments through fraudulent online trading platforms.
US agencies warn attackers are going after industrial refrigeration controllers. The fixes are basic, and most start with getting them off the internet. CISA, the FBI, HHS, USDA and the Department of Transportation published a joint advisory on attacks against industrial refrigeration controllers and cold chain monitoring systems. The activity is global. Healthcare, chemical, food and transport companies use these systems to watch temperatures, keep logs, run defrost cycles and save energy, including in refrigerated trucks. “The authoring organizations are aware of malicious cyber actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities.” reads the advisory published by CISA. “The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.” The targets are electronic temperature controllers and commercial refrigeration controllers used in grocery stores and cold-storage sites. Attackers may exploit flaws in unpatched or internet-accessible controllers to change settings remotely and force units into continuous heating and defrost cycles. In plain terms, someone could cook your freezer from the other side of the world. The agencies identify three ways in: bypassing authentication, injecting arbitrary code, and exploiting weak configurations. Once inside, an attacker can change temperatures, which can shorten equipment life, create a fire hazard and destroy stock. Spoiled products that reach consumers can also create a safety risk. “The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.” continues the adviosry. An attacker can also hide the damage. Operators lose sight of current temperatures, and that’s a bad moment to learn a cold room has been warm for hours. CISA’s Chris Butera adds that every organization that depends on these systems should assume it’s a target. The advice follows the Cross-Sector Cybersecurity Performance Goals from CISA and NIST, a minimum set of practices for any organization. Start with exposure. Keep controller panels off the internet, and if you need remote access, put an up-to-date firewall or similar gateway in front of it. Then separate industrial equipment from the office network with its own virtual network. Next, fix the basics. Change default passwords, use strong ones, and add phishing-resistant multifactor authentication where you can. Update firmware, and retire or replace devices the maker no longer supports. Allow only trusted devices and IP addresses to change system settings. Keep tested backups in a separate location, disconnected from the network. Enable logging and regularly check the logs. If devices do not record activity, monitor the network traffic between them. U.S. organizations should report suspicious activity to CISA’s 24/7 operations center or the FBI’s Internet Crime Complaint Center. Healthcare organizations can also contact HHS. Reports should include the date, time and location of the incident, a description of the activity, the number of people affected, the equipment involved, and a contact person within the organization. One control gets forgotten more than the rest. A controller shouldn’t be able to push a freezer past what’s safe, whoever is giving the orders. “The authoring organizations strongly urge industrial refrigeration and cold chain monitoring system owners and operators to secure remote access to their OT systems.” concludes the report. “To strengthen system security, owners and operators should review the following resources and implement recommended mitigations: United Kingdom’s National Cyber Security Centre and Partners: Secure Connectivity Principles for OT“ CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology CISA: Defend the Edge: The Critical Importance of Edge Device Security CISA: Internet Exposure Reduction Guidance Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
The BBC plans to use emergency FM radio to keep the UK informed during prolonged blackouts, with a self-sufficient studio ready for 72 hours. If electricity fails across the UK for days, the BBC says it has a plan to keep people informed. David Sillito, the BBC’s media and arts correspondent, explained the strategy in a BBC News report, starting with the 2015 Lancaster floods and ending with a simple lesson: when digital infrastructure fails, FM radio may be the most reliable way to reach the public. On December 5, 2015, the River Lune flooded Lancaster, cutting electricity to 61,500 people. Roger Kemp, an engineering professor at Lancaster University specializing in safety and electrical systems, was watching television when the power went out. The following day, he described the scene to the BBC as almost resembling a zombie movie, with residents searching for phone reception and queuing at the only working telephone box. Homes lost heating and lighting, while some water supplies stopped because their pumps depended on electricity. Railway stations, petrol stations and shops closed, cash machines stopped working, and traffic lights failed. Only two communication systems remained operational: copper landlines and FM radio. Local station The Bay continued broadcasting using an emergency generator and a single landline. Kemp’s subsequent report highlighted the irony: a society increasingly dependent on digital infrastructure had relied on technologies dating back decades to receive essential information. The incident illustrated the risk of a wider catastrophe known as a Black Sky event, in which electricity, water, shops and communications fail simultaneously. At a recent UK resilience summit, discussions focused on maintaining essential services for at least 72 hours. One expression often heard in civil contingency circles, “nine meals from anarchy”, captures the concern that three days without food could turn an emergency into widespread disorder. “We are nine meals from anarchy” is a phrase often heard in the civil contingency world. A brutal reminder of the fear that three days without food would be enough to turn a crisis into chaos. If a Black Sky event takes out electricity, water, shops and communications, there is a good reason the government wants us to have our own supplies.” BBC states. “In a major emergency, we are being told to hunker down and turn on an FM radio, as thousands did in Lancaster. This is why the BBC has its own Black Sky plan.” The government’s Be Ready campaign warns that severe weather and cyberattacks could disrupt essential services, although it says there is no specific threat to the electricity grid. According to government advice reported by the Express, households should maintain at least three days of food and drinking water and keep a battery-powered FM radio. Sillito also recommends a hand-cranked radio that can generate its own power. The BBC’s contingency plan revolves around precisely this technology. Around 100 people would operate a dedicated emergency radio studio, equipped with secure communications independent of the internet, alongside enough fuel, water and food to survive at least three days without resupply. Reports published by French outlet Telesatellite and Open magazine on November 7 describe a self-contained studio, generators powering transmission facilities and FM radio as the fallback communication channel. Only a small number of BBC staff know the complete details. The studio would broadcast pre-prepared government announcements, with scripts already published online. These include practical instructions on daily water consumption and disposing of toilet waste when flushing is impossible. Additional reporting would come from satellite vehicles and journalists stationed at emergency centres across the UK. Transmission towers, disconnected from the internet, would use diesel generators and storage tanks ranging from 5 to 40,000 litres, providing approximately three days of power. Satellite phones would support communications between teams, with agreed meeting points and procedures if those systems also failed. FM radio remains central because it can reach almost everywhere, even during a major blackout or disruptive cyberattack. The BBC’s planning assumptions have evolved. An insider told Sillito that the original scenario considered outages lasting five to seven days, while the latest advice from the National Energy System Operator suggests electricity could return within two to three days. The corporation’s contingency arrangements have surfaced before. In October 2022, media reports described leaked draft scripts for a national blackout, including half-hourly Radio 4 updates from an emergency broadcasting centre at an undisclosed rural location. There is, however, a discrepancy in the Express report, which claims that only around 100 people worldwide know the full details. The BBC says approximately 100 people would operate the emergency studio, while only a small number have access to the complete plan. Concerns about grid resilience are not new, but the massive blackout affecting Spain, Portugal and south-western France in April 2025 renewed attention to the issue. Lord Harris, chair of the National Preparedness Commission, argues that the consequences extend well beyond losing electricity. Water supplies could stop because pumping stations need power, while sewage systems could become blocked when water can no longer circulate. Governments across Europe increasingly advise citizens to maintain emergency supplies, and Harris believes the UK has been slow to prepare its population. Some initiatives are already underway. ARIA, the government’s Advanced Research and Invention Agency, is investing £70 million in high-altitude aircraft designed to provide at least a week of emergency mobile and internet connectivity over the UK. Programme director Rico Chandra has warned that satellites alone have limitations when terrestrial networks fail. Harris argues that decades of efficiency-driven decisions have gradually removed essential redundancies. One example is the migration of emergency services from dedicated radio systems to mobile network technology, potentially exposing their communications to the same outages affecting the public. The government maintains that the transition to 4G and 5G provides reliable and resilient communications. “The UK has one of the most resilient electricity systems in the world, and there has never been a complete outage in the grid’s 75-year history.” The Cabinet Office states describing the UK electricity system. Government efforts to improve resilience predate the current debate. In May 2024, then deputy prime minister Oliver Dowden launched the previous Conservative government’s disaster preparedness initiative. During his investigation, Sillito also reconsidered the BBC’s isolated transmission infrastructure. What initially appeared outdated became a strength: independence from the internet could help keep broadcasting alive when digital networks collapse. Yet the UK is preparing to switch off its copper landline network on January 31, 2027, while the future of FM radio is also under review. The government’s position is that copper landlines, although useful during power cuts, have become unreliable and increasingly difficult to maintain. Kemp is less convinced that the country is moving in the right direction. Asked whether his report had improved national preparedness for a Black Sky event, he argued that the planned landline shutdown showed little consideration for how people would communicate during a prolonged power failure. Sillito experienced a smaller reminder while preparing his report: a power cut in his own street, leaking torch batteries, missing candles and an emergency radio he could not find. His conclus: “If anything, we’ve gone backwards,” he said. “Switching off the public switch telephone network, I think shows that there has been really no thought at all about how you communicate when you’ve no longer got power.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, BBC)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks. The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement
Hunt.io traced ARTEX servers and AI-powered hacking tools used in breaches affecting seven South Korean financial institutions. Between late September and early October 2026, seven South Korean financial institutions had data breached through internet-facing systems. About 66,000 to 67,000 people and around 2,200 corporations were affected, and personal, employment, income and loan data was exposed. Hunt.io dug into the infrastructure behind the campaign, and its findings add a lot to what CrowdStrike and Genians already published. CrowdStrike reported on October 7 and Genians Security Center on October 12, and both pointed to ARTEX, an open-source autonomous penetration testing framework developed in China and licensed under AGPL-3.0. CrowdStrike assessed with moderate confidence that a single Chinese-speaking individual motivated by money ran it, and not an established threat group. DeepSeek v4.1 Flash was the main model, with GLM 5.3 and Grok 4.6 as backups, reached partly through a reseller domain, xcai[.]pro. The public indicators were a server at 38.244.50[.]120, which hosted the ARTEX console, plus a Hong Kong address and nine proxies. Genians said the ARTEX GitHub repository and Docker image were removed on October 11, though forks and mirrors remain. “CrowdStrike assessed with moderate confidence that the operator was a single Chinese-speaking individual motivated by financial gain rather than an established threat group.” reads the report published by Hunt.io. “The infrastructure reportedly accessed these services in part through the reseller domain xcai[.]pro. Both reports described a two-server configuration, consisting of a Hong Kong-based IP address used as primary infrastructure and 38.244.50[.]120, which hosted the ARTEX console.” Hunt.io notified the relevant national CERT before publishing, and says the report holds no personal records or credentials. The company’s own scanning showed 38.244.50[.]120 sits on Cogent’s network in Los Angeles, with 15 open ports. The ARTEX login page, with a Chinese title meaning “autonomous penetration testing console”, appears on ports 443 and 8090. Other services include a Gemini2API admin console and a Tinyproxy server. Searching its AttackCapture platform for that address, Hunt.io found another open directory at 23.248.226[.]250, a jump server in Hong Kong on AS138415. It held 42 files in 2 subdirectories, 105 MB in all, and the platform had logged warnings on September 5, September 26 and October 5. A file in it names 38.244.50[.]120 as the jump host, and its own comment tells the operator never to paste the credentials into a session. It sat in an open directory. Three scripts back up the link. They keep reverse SSH tunnels alive, run a local relay, and copy files to the jump host, one tunnel is named grok2api, and the credentials file also holds keys for Zhipu AI’s GLM models, an OpenAI-compatible relay and a proxy service. That explains how several language models ran in one campaign. The AI setup is the most striking part. A state file shows the harness is Claude Code itself, version 2.1.221, started 510 times since August 4, but it isn’t talking to Anthropic. A small proxy, ds-models-shim.py, fixes a compatibility problem by faking a model list and sending requests to DeepSeek, and another, xcai-effort-shim.py, adds a reasoning setting because the DeepSeek backend otherwise skips its reasoning step. The route runs from Claude Code through Claude Code Router, an open-source project, to xcai and then to DeepSeek. “A small local proxy, ds-models-shim.py, addresses a compatibility issue: the official /v1/models endpoint returns a 404 response when queried against a non-Anthropic backend, preventing Claude Code from discovering the available models. The shim intercepts that specific request and returns a locally defined model list containing deepseek-v4-pro and deepseek-flash. All other requests are forwarded to api.deepseek.com/anthropic.” states the report. The same file counts 19 custom skills, reusable instruction sets for the agent, with 147 recorded uses. They cover code audit, reconnaissance, web injection, WAF bypass testing, authentication testing, Telegram Mini Apps, APK download and decompiling, cloud phone control and payment logic testing. Next to the payment skill sat three self-registered test accounts with tokens for a cash-in deposit API, dated September 12, and a comment calls them an authorized, self-built test. The setup fits testing for insecure direct object reference flaws, a technique CrowdStrike and Genians described against Korean loan and inquiry services. The directory also held supporting tools. A script queried FOFA, a Chinese asset search engine like Shodan, through a third-party API, and a comment says the primary membership had expired and a backup key was in use. Proxy scripts enumerated a rotating proxy service at 154.201.79[.]246:443, where 79 unique exit IPs showed up among the first 100 identities tested. A separate directory at 23.248.226[.]250:8001 held a small staged setup for JNDI and LDAP exploitation, retrieved on October 5 at 03:42 UTC. It confirms command execution through a DNS callback, and one script lets web and LDAP traffic share a single port. Hunt.io’s analysis describes the tooling without publishing steps to reproduce it. Other recovered files include tools aimed at a cryptocurrency exchange’s admin session and withdrawals, Linux privilege escalation exploits, iOS probe source code and Android kernel and firmware utilities. Hunt.io says their connection to the Korean breaches isn’t confirmed. Hunt.io then showed how to hunt ARTEX servers. Searching for an ARTEX certificate issuer returned 19 IP addresses, and searching its malware classification returned 1,303 addresses across 30 countries, led by the United States, China and Hong Kong. Those figures show where addresses are registered, not where the operator sits. “The result returned 19 distinct IP addresses, including 38.244.50[.]120. This method is precise but limited to hosts that expose a matching certificate. Systems using a different certificate will not appear in these results.” continues the report. Matching the console’s page title returned about 1,300 IPs, and a looser search found 21 title strings, 19 of them likely ARTEX consoles, in English, Chinese, Korean, Japanese, Russian, Portuguese and Vietnamese. A malware-name search in AttackCapture gave 280 results with open directories. One at 130.94.31[.]86:18888 in Seoul held two small scripts, and another at 156.251.11[.]39 held an SMB reconnaissance toolkit whose test script writes a file named artex_probe_11876.txt. More hosts held exploitation kits for DedeCMS and FangCMS, a CAPTCHA bypass suite, a RuoYi and Spring administrative console exploit and CAPTCHA-based login automation. Together they show the framework attracting many operators. For defenders, the advice is plain. Remove public access and put administration behind VPNs or allowlists, and reset SSH passwords and rotate API keys, proxy credentials and tokens that exposed files may have revealed. Patch internet-facing services, watch for unexpected LDAP and JNDI activity, DNS callbacks and remote script downloads, and store secrets in a managed vault with least-privilege permissions. Also restrict access to model gateways, watch their requests, and enforce compliance rules on managed phones. Hunt.io’s lesson is that an investigation shouldn’t stop at the first list of indicators, because The company also published indicators of compromise in its analysis. “The findings highlight risks associated with exposed administrative services, reusable credentials, remote access tunnels, proxy infrastructure, and exploitation tooling.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ARTEX)
U.S. CISA adds SonicWall SonicOS SSLVPN vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SonicWall SonicOS SSLVPN flaw, tracked as CVE-2026-19868 (CVSS score of 7.5), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-19868 is an authentication bypass vulnerability affecting the SSL VPN service in SonicWall SonicOS. “An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).” reads the advisory. The flaw occurs when the system does not properly enforce SAML authentication controls. An attacker who already has valid credentials for an alternative authentication method may exploit this weakness to bypass SAML-based authentication. The impact is particularly serious when organisations rely on SAML to enforce multi-factor authentication (MFA). Successful exploitation may allow an attacker to access the SSL VPN without completing the expected SAML authentication process, potentially bypassing the additional MFA protection. In practical terms, the vulnerability could weaken an organisation’s remote access security by allowing users with alternative valid credentials to circumvent its intended authentication controls. It’s important to highlight that this is not an unauthenticated remote access vulnerability. The attacker needs valid credentials for an alternative authentication method, but may then bypass SAML-enforced security controls. SonicWall’s PSIRT team is investigating a report of possible exploitation of this flaw. The company strongly recommends that customers install the latest available update as soon as possible to reduce the risk of attacks. “SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.” reads the advisory. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by November 20, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks. The vulnerability, tracked as CVE-2026-19868, allows attackers with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication (MFA). The flaw has a CVSS severity score of 7.1 and only affects SonicOS SSL-VPN services configured to use SAML authentication. In a security advisory published Friday, SonicWall warned that it had investigated a report that the vulnerability was exploited in an attack and urged customers to install the latest security updates. "SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks," the company warned.
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file. Software security company Apiiro said yesterday that 1,122 public
Confirm this action.
Leaving now will discard your changes.