A developer built USAP, an open-source system that enforces a strict evidence gate for LLM security verdicts, requiring every verdict to cite a resolvable source. The system rejects hand-wavy output b…
The National Institute of Standards and Technology (NIST) announced on April 15, 2026, that the National Vulnerability Database (NVD) will adopt a risk-based triage model, abandoning universal enrichm…
Over 45,000 CVEs were published in 2025, and AI-driven zero-day threats are shrinking the window between disclosure and exploitation from weeks to hours. Ivanti's Sydney Lesser advises organizations t…
The rise of AI-driven software development and CI/CD pipelines is challenging traditional vulnerability management systems like CVE and CVSS, as codebases are rapidly rewritten and vulnerabilities are…
Faultline Security offers manual penetration testing for startups and SaaS companies, priced from €3,000, to help them pass Series A security due diligence. The service provides clear scope, fixed pri…
A security researcher demonstrated that a GitHub PR title, issue body, or comment can serve as a prompt injection to hijack Claude Code, Gemini CLI, and GitHub Copilot running in GitHub Actions, causi…
Two critical vulnerabilities were disclosed last week in the MCP ecosystem, putting hundreds of thousands of servers at risk. A flaw in the nginx-ui MCP endpoint allows unauthenticated attackers to ac…
The article explains the Common Vulnerability Scoring System (CVSS), which uses a vector string to describe the severity and characteristics of a security vulnerability, not just a single numerical sc…