Socket Weekly: AI Industry Backs Open Weights, 53 Slopsquatting…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-new-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

The AI Industry Is Betting on Open Weights

Fifty companies, from NVIDIA and Microsoft to Mistral and Hugging Face, signed an open letter urging Washington not to restrict open-weight AI. They have a case: Kimi K3 just passed Claude Fable 5 to take #1 in the Frontend Code Arena, months after the US government pulled Fable offline worldwide days after its launch. The letter makes the case on cost, competition, and sovereignty, but its strongest claim is that openness makes AI more secure, since closed models can be breached or fail in ways outsiders cannot detect.

MORE NEWS

Large-Scale GitHub Actions Abuse Powers a Distributed cPanel and WHM Exploitation Campaign

Attackers planted malicious workflow files across ten compromised repositories, turning GitHub-hosted runners into disposable infrastructure to exploit a cPanel and WHM authentication bypass and steal server credentials. Installing the packages does nothing, execution only fires on a push, and one identifier surfaced roughly 15,000 matching workflow files across unrelated repos.

New Study Identifies 53 Slopsquatting Targets Across 5 Frontier LLMs

Independent research across nearly 200,000 code-generation responses found Claude, GPT, Gemini, and DeepSeek all inventing the same nonexistent package names, 53 of which are still registrable on PyPI and npm. One malicious registration could reach developers on any of those tools.users.

Never let a signup go cold again.

Turn emails into revenue with Brew. No credit card, free credits to try.

Socket Weekly: AI Industry Backs Open Weights, 53 Slopsquatting…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-new-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

The AI Industry Is Betting on Open Weights

Fifty companies, from NVIDIA and Microsoft to Mistral and Hugging Face, signed an open letter urging Washington not to restrict open-weight AI. They have a case: Kimi K3 just passed Claude Fable 5 to take #1 in the Frontend Code Arena, months after the US government pulled Fable offline worldwide days after its launch. The letter makes the case on cost, competition, and sovereignty, but its strongest claim is that openness makes AI more secure, since closed models can be breached or fail in ways outsiders cannot detect.

MORE NEWS

Large-Scale GitHub Actions Abuse Powers a Distributed cPanel and WHM Exploitation Campaign

Attackers planted malicious workflow files across ten compromised repositories, turning GitHub-hosted runners into disposable infrastructure to exploit a cPanel and WHM authentication bypass and steal server credentials. Installing the packages does nothing, execution only fires on a push, and one identifier surfaced roughly 15,000 matching workflow files across unrelated repos.

New Study Identifies 53 Slopsquatting Targets Across 5 Frontier LLMs

Independent research across nearly 200,000 code-generation responses found Claude, GPT, Gemini, and DeepSeek all inventing the same nonexistent package names, 53 of which are still registrable on PyPI and npm. One malicious registration could reach developers on any of those tools.users.