A developer has detailed how a single-line mass assignment flaw in a PATCH /api/users/me endpoint lets any authenticated user promote themselves to admin by sending a role field in the request body, a…
CISA's new "Quality Era Framework" warns that AI-powered bug discovery could expose gaps in the CVE programme's processes, tooling, coordination and accountability, with CVE publications set to reach …
A security analysis outlines seven entry points in the AI supply chain that typical security reviews miss, including malicious pickle model files, backdoored weights, training-data poisoning, compromi…
UltraViolet Cyber launched Equinox, a proprietary detection engineering platform built and operated by its Threat Intelligence & Detection Engineering (TIDE) team, which uses AI and automation to maxi…
A new GenAI security glossary compiles the core vocabulary and attack/defense terms used in real design reviews, red-team reports, and the OWASP, NIST, and MITRE frameworks. The glossary covers concep…
The average time from vulnerability disclosure to first attack has dropped from 63 days in 2018 to minus seven days, meaning attackers now exploit holes about a week before vendors ship patches, accor…
JFrog's security team exposed a wave of fabricated SQLite vulnerability advisories, including a fake CVE-2026-51302 that was initially rated 10.0 critical, which had flowed through NVD, CISA, and Red …
MITRE released a Framework for Continuous Remote Attestation in July 2026, developed with Fr0ntierX and Invary, to address the risk of eBPF layer tampering that can feed corrupted telemetry to AI syst…
MITRE has released a new Framework for Continuous Remote Attestation, co-authored with Invary and Fr0ntierX, now open for public review, to verify system trustworthiness continuously during runtime ra…
In a podcast, Tracy Bannon, Senior Principal Software Architect and DevOps Advisor at MITRE, discussed the risks of agentic AI in software development, emphasizing that AI agents crossing system bound…
Cursor, the AI code editor used by 70% of the Fortune 500, has earned AIUC-1 certification for agent security and reliability after an independent audit by Schellman and adversarial testing across tho…
AI coding tools now generate 42% of committed code, projected to reach 65% by 2027, yet the security pass rate has stalled at 55% since 2023, according to Veracode's July 2026 GenAI Code Security Repo…
The Artificial Intelligence Underwriting Company published AIUC-1, a standard for AI agents covering data privacy, security, safety, reliability, accountability, and societal risk, with contributions …
NATO's Cyber Security Centre and AI startup AISLE have joined the CVE program as numbering authorities under the ENISA Root, enabling them to assign unique identifiers to software vulnerabilities, the…
Lovable has become the first AI coding agent platform to earn AIUC-1 certification, the industry's first security, safety, and reliability standard for AI agents. Developed with input from Stanford, M…
JFrog Security Research reported that 54 of 55 CVE advisories published from a new GitHub account were AI-hallucinated, with six targeting SQLite and all six entering the National Vulnerability Databa…
A GitHub account published 55 security advisories for SQLite, 54 of which were fabricated and one contained a real bug, according to a JFrog audit. The NIST National Vulnerability Database (NVD) regis…
JFrog reported that six SQLite CVEs published by a new GitHub repository were fake, likely AI-generated, with CVSS scores ranging from 9.8 to 7.5, and none described a reproducible vulnerability. The …
JFrog's security research team found that 54 of 55 SQLite advisories filed as critical CVEs were fabricated by an AI language model, including CVE-2026-51302, which was withdrawn four days after publi…
X-cmd v0.9.14 adds two command-line modules, `x cve` and `x cwe`, for querying CVE vulnerability IDs and CWE weakness categories, respectively. Founder and CEO Edwin Lee argues that as AI agents mass-…