OpenSSH 10.5, released August 11 just five weeks after 10.4, breaks the project's traditional release cadence in response to a flood of security reports from AI models, with maintainers announcing mor…
Apple has capped the number of vulnerability reports a researcher can file at once after being swamped by AI-generated submissions, a move that prevented Milan-based cybersecurity startup Bynario from…
A CEO spent $10,000 on AI model API credits to hunt for vulnerabilities in Bitcoin's codebase, highlighting a shift toward AI-powered security research in crypto. Immunefi CEO Mitchell Amador describe…
Security researcher elder-plinius released T3MP3ST, an open-source meta-harness that turns AI coding agents like Claude Code and OpenAI Codex into autonomous red-team operators, scoring 90.1% pass@1 o…
GitHub cut its public bug bounty payouts by at least 50% across all severity levels effective July 27, 2026, and moved top rewards to an invite-only VIP tier, citing a flood of AI-generated spam repor…
GitHub has restructured its bug bounty program to prioritize quality over quantity, introducing a VIP tier with significantly higher payouts for researchers who meet benchmarks based on finding severi…
Google's Big Sleep AI agent found a live memory-safety bug in SQLite (CVE-2025-6965) and got it patched before exploitation, marking the first time an AI has foiled a real exploit pre-deployment. A ho…
GitHub is overhauling its bug bounty program starting July 27, slashing public payouts by up to 67% while reserving higher rewards for an invite-only VIP program, citing a flood of low-effort and AI-g…
Independent security researcher Ayush Paul demonstrated a link-walking exploit against Anthropic's Claude that exfiltrates user memory data by encoding it into URL paths, while a second researcher, Jo…
A critical zero-day vulnerability in Cursor, the AI-assisted development environment with 7 million+ active users, allows arbitrary code execution on Windows when a developer opens a repository contai…
OpenAI launched Patch the Planet, a program using AI with human review to find and fix open-source security vulnerabilities, after AI-generated reports overwhelmed bug bounty programs. In a five-day s…
Anthropic has published a structured framework for rating the severity of AI jailbreaks, called the Cyber Jailbreak Severity (CJS) scale, which ranges from CJS-0 (Informational) to CJS-4 (Critical). T…
OpenAI launched Patch the Planet on June 22, 2026, deploying AI agents to audit and patch open-source software, finding hundreds of vulnerabilities in the first week including four dnsmasq CVEs, a 23-…
OpenAI, Trail of Bits, HackerOne, and Calif launched Patch the Planet on June 22, an open-source security initiative using AI-assisted vulnerability research with mandatory human review. The first fiv…
The Trump administration's AI cybersecurity clearinghouse, mandated by executive order, missed its 30-day deadline to coordinate vulnerability scanning and patching in critical infrastructure. Experts…
ZkSecurity's AI audit pipeline discovered seven real bugs in Cloudflare's CIRCL cryptography library, including a critical float64 precision loss in threshold RSA and a complete access-control break i…
Security researchers at Aikido discovered that Rocket.Chat's use of MongoDB's ObjectId() for file IDs allows unauthenticated attackers to predict and access any uploaded file. The vulnerability, repor…
Node.js is considering a proposal to move lower-severity security reports into a public workflow due to an overwhelming surge in AI-generated vulnerability submissions. Security maintainer Rafael Gonz…
A critical authentication bypass vulnerability in phpBB's default configuration, tracked as CVE-2026-48611, allows unauthenticated attackers to log in to any account with a single request. Discovered …
OpenAI's GPT-5.5-Cyber, launched under the "Patch the Planet" initiative with Trail of Bits, has filed 64 pull requests and 51 issues across 19 open-source projects including cURL, Python, and Go in i…