Win11 Zero-Days, npm Supply Chain, & AI Agent Security Threats

Short summary

Windows 11 faces two critical zero-days (Bitlocker bypass and LPE privilege escalation) with public PoC code available. An npm supply chain attack compromised 170+ packages with 400+ malicious versions, indicating pipeline vulnerabilities. New research reveals LLM-based coding agents can be manipulated to introduce vulnerabilities, requiring advanced prompt security and runtime monitoring.

• •Windows 11 zero-day disclosures: Bitlocker bypass (YellowKey) and LPE exploit (GreenPlasma) with public PoC code available
• •Large-scale npm supply chain attack: 170+ packages, 400+ malicious versions, affecting TanStack and Mistral AI
• •Malicious AI coding agent skills: LLMs can be prompted to generate insecure code or exfiltrate data, requiring new defensive strategies

Generated with AI, which can make mistakes.