A security analysis warns that AI-powered vulnerability discovery is outpacing human remediation capacity, citing more than 66,000 CVEs recorded by mid-September 2026 — double the 2025 pace — and Orac…
Researchers released CVSS-X, a synthetic speech-to-speech translation corpus that translates English into 28 target languages across 12 language families, comprising roughly 240,000 parallel speech pa…
In the first half of 2026, 35,853 CVEs were published, roughly 49% more than the year before, but only 495 were catalogued as exploited in the wild, according to VulnCheck data cited in a Picus Securi…
A developer who built a vulnerability triage CLI called triage-lens admitted they initially did not understand the EPSS, KEV, or CVSS scores the tool relies on. The tool, which passed 373 tests and sh…
Intigriti was named the new provider for Adobe's Bug Bounty Program effective September 1, 2026, with Intigriti Founder and CEO Stijn Jans calling it "the start of a long and rewarding partnership." T…
Security researchers disclosed a CVSS 10.0 vulnerability in AI coding agents from three vendors, including Claude Code, Gemini CLI, and OpenAI Codex, stemming from a time-of-check-to-time-of-use (TOCT…
Palo Alto Networks' Unit 42 research team has developed an autonomous multi-agent pipeline using frontier AI models that discovered 14,090 vulnerabilities in open-source software, with 14,005 new cand…
A developer built USAP, an open-source system that enforces a strict evidence gate for LLM security verdicts, requiring every verdict to cite a resolvable source. The system rejects hand-wavy output b…
The National Institute of Standards and Technology (NIST) announced on April 15, 2026, that the National Vulnerability Database (NVD) will adopt a risk-based triage model, abandoning universal enrichm…
Over 45,000 CVEs were published in 2025, and AI-driven zero-day threats are shrinking the window between disclosure and exploitation from weeks to hours. Ivanti's Sydney Lesser advises organizations t…
The rise of AI-driven software development and CI/CD pipelines is challenging traditional vulnerability management systems like CVE and CVSS, as codebases are rapidly rewritten and vulnerabilities are…
Faultline Security offers manual penetration testing for startups and SaaS companies, priced from €3,000, to help them pass Series A security due diligence. The service provides clear scope, fixed pri…
A security researcher demonstrated that a GitHub PR title, issue body, or comment can serve as a prompt injection to hijack Claude Code, Gemini CLI, and GitHub Copilot running in GitHub Actions, causi…
Two critical vulnerabilities were disclosed last week in the MCP ecosystem, putting hundreds of thousands of servers at risk. A flaw in the nginx-ui MCP endpoint allows unauthenticated attackers to ac…