A security researcher found a post-auth remote code execution vulnerability in Cisco Smart Software Manager (CSSM) that was silently patched in Cisco's 10-202608 upgrade, uploaded on 10 Aug 2026. The …
A developer measured Caddy 2.11.4's default post-quantum TLS handshake and found the hybrid X25519MLKEM768 key exchange inflates the ClientHello and ServerHello from a combined 440 bytes to 2704 bytes…
A developer outlines how a seemingly simple webhook endpoint evolves into a small distributed system, requiring signature verification, durable ingress, asynchronous workers, and handling of duplicate…
OpenSSL reports that AI-driven vulnerability discovery has increased its monthly security reports from nine to about 70 in a year, raising concerns about funding for the security teams expected to add…
A new open-source tool, extract_masterlist.py, parses ICAO/BSI CSCA Master Lists and exports country signing CA certificates as PEM bundles or TSV manifests, handling 581 entries across 112 countries …
OpenSSL 3.5+ now natively supports all three NIST post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA), and a hands-on test shows that post-quantum certificates are dramatically larger than classical one…
A developer detailed a privacy-preserving inference pipeline for health data using Intel SGX and Gramine, demonstrating how to build a secure C++ inference engine that encrypts data even from the host…
Danny Arends, a long-time D language developer, has built DLLM, a minimal coding agent in D that runs directly on llama.cpp without Python or bindings, using D's ImportC feature to access the C API wi…
Closed-source software no longer protects design secrets because AI can now reconstruct programs by observing their behavior, according to a June test by Epoch AI and METR called MirrorCode. The best …
A new benchmark called ExploitGym finds that frontier AI agents can autonomously turn real-world security vulnerabilities into working exploits, achieving unauthorized code execution on 869 tasks span…
A researcher extracted data from Anthropic's Claude agents by tricking them into navigating a malicious site, while Grok's coding agent uploaded entire codebases and Git history to xAI servers even wh…
A developer shipped the first public release of AgentOS, a Rust runtime layer for AI agents, and encountered two CI failures within 20 minutes. The first was a clippy lint fix, and the second involved…
AWS has released a developer bootloader for AWS DeepRacer devices that allows installation of custom operating systems, extending the life of the autonomous 1/18th scale race cars originally shipped w…
The EU Cyber Resilience Act's vulnerability reporting obligations begin September 11, 2026, not the widely cited December 11, 2027 deadline, creating an urgent compliance gap for manufacturers using e…
Chapel 2.9 shipped on June 18 with LLVM 22 and CUDA 13 support, a prototypical dynamic library loading feature for distributed parallel code, a browsable Mason package registry, and union types that h…
Researchers introduced ANYPoC, a multi-agent framework that automates bug validation by generating executable proofs of concept. The system outperformed state-of-the-art coding agents like Claude Code…
A new approach to cybersecurity evaluations proposes using language models as constant red-team oracles to empirically compare the attack surfaces of different software implementations, such as OpenSS…
AI security firm AISLE discovered six new CVEs in curl, including the oldest latent bug in the project's history, and previously found all 12 zero-day vulnerabilities in OpenSSL's latest security rele…
AskHuman launched a no-install, end-to-end encrypted HTML artifact sharing service for AI agents. The server stores ciphertext for seven days, with decryption keys passed via URL fragments, enabling s…
Puppet has published guidance on remediating 18 OpenSSL vulnerabilities at scale using its infrastructure automation platform. The June 2026 advisory includes a high-severity heap use-after-free bug i…