Good morning. This is your security briefing for Saturday, April 11, 2026, covering 7 articles from yesterday's developments. All attribution is by the article authors. All article analysis is automated.
Kirill Boychenko reports that North Korean threat actors conducted a supply chain attack called 'Contagious Interview' targeting five major open-source ecosystems: npm, PyPI, Go Modules, crates dot i o, and Packagist. The campaign deployed malicious packages impersonating legitimate developer tools to steal credentials, browser data, password manager contents, and cryptocurrency wallets, with some variants delivering full remote access trojan capabilities including remote shell execution and keylogging.
The Product Security DevOps Team reports on a vulnerability in the wolfSSL cryptographic library caused by missing hash digest size and OID checks during ECDSA signature verification. The flaw affects ECDSA and ECC verification when EdDSA or ML-DSA is enabled, allowing acceptance of smaller-than-permitted digests and reducing the security of ECDSA certificate-based authentication, though there is no indication of active exploitation at this time.
Research by Hanzhi Liu, Chaofan Shou, Hongbo Wen, Yanju Chen, Ryan Jingyang Fang, and Yu Feng identifies malicious intermediary attacks targeting large language model API routers in the supply chain. Analysis of 428 routers revealed 9 actively injecting malicious code through payload injection and secret exfiltration techniques, demonstrating exploitation of leaked keys and weak relay chains to compromise LLM services.
Little Snitch for Linux has been released by obdev dot a t, providing users with the ability to monitor and control outgoing network connections from applications using eBPF integration. The tool offers visibility into application network activity, allows blocking of unwanted connections through rules and blocklists, and includes a web-based interface, designed primarily as a privacy tool for Linux users running recent kernel versions with BTF support.
The Mindcore Techblog reports that Secure Boot certificates expiring in 2026 require Windows devices to transition to new Windows UEFI Certificate Authority 2023 certificates. Mattias Melkersen KalvΓ₯g provides a technical implementation using Intune Remediations with PowerShell scripts to automate certificate updates across managed Windows devices, warning that failure to update before expiration could result in boot failures or compromised boot-level security protections.
Sesh Nalla and Claude Code describe the development of redis-rust, a Redis-compatible in-memory data store built using AI-assisted programming with deterministic verification methods. The project implemented a multi-layer verification pyramid with mechanical pass-fail criteria to ensure correctness of the distributed system, identifying six production-grade bugs through rigorous testing, and uses an actor-per-shard design with CRDT-based replication and hybrid persistence combining write-ahead logging with object storage.
Researchers on GitHub successfully reverse-engineered Google's SynthID watermarking system used to identify AI-generated images from Gemini. They developed a detector with 90% accuracy and created a bypass method using multi-resolution spectral codebook analysis that achieves 91% phase coherence drop, effectively removing the watermark and demonstrating circumvention of AI content detection through spectral analysis and frequency-domain signal subtraction.
That concludes today's briefing.