Cybersecurity news — data breaches, vulnerability disclosures, AI-powered security tools, threat intelligence, and enterprise security research.
OpenGuard is an open-source, self-hosted static code analysis platform that serves as an alternative to tools like SonarQube, enabling developers to scan codebases, track security issues, and manage remediation efforts. …
Google published exploit code for an unfixed vulnerability in the Chromium browser codebase, affecting Chrome, Microsoft Edge, and other Chromium-based browsers. The proof-of-concept code exploits the Browser Fetch API, …
President Donald Trump requested $1 billion in taxpayer funding for security upgrades to a White House ballroom project, including a rooftop hardened against drone strikes and a "drone port" for military drones. The rema…
LangGraph, a popular framework for building multi-agent workflows, is vulnerable to **Memory Poisoning (ASI06)**, where a malicious payload written to shared state by one agent can compromise all other agents. To defend …
MCP (Model Context Protocol) server integrations are not inherently dangerous, but the primary security risk lies in how vendors build and configure them. It warns that most buyers fail to scrutinize critical architectur…
The primary risk from AI in software development is not poor code quality but a lack of code provenance, traceability, and attribution. It advises teams to shift focus from choosing the best AI model to improving workflo…
A security analysis of 39 AI companies found that 26 use an SPF "softfail" policy, meaning spoofed emails from domains like Anthropic, Google, and NVIDIA can still be delivered to inboxes. Additionally, 9 out of 39 domai…
DEPOSE, a cryptographic forensic framework designed to create verifiable audit trails for AI coding agent sessions (like Claude Code or Codex CLI). It addresses the problem that standard session logs (JSONL files) are no…
Importance of building secure and efficient AI agents that operate directly on consumer hardware rather than relying on cloud services. It highlights security risks like the CISA Admin leak of AWS GovCloud keys, and reco…
AI security cannot be effectively measured through benchmarks alone, as benchmarks fail to accurately assess AI capabilities, particularly complex properties like security. Instead, it suggests that AI security should fo…
Per-user OAuth is essential for AI agents because it allows each individual user to grant the agent a scoped, revocable token tied to their own account, solving the security and auditability problems caused by shared API…
Snyk's agent-scan tool analyzes MCP servers by actually executing them from the user's configuration files, retrieving tool descriptions via the MCP protocol, and sending that data to a third-party API for analysis. This…
In an experiment detailed on the AfterPack blog, an AI agent (Claude Code) successfully deobfuscated two JavaScript files—one from an open-source obfuscator and one from a commercial enterprise product—in 10 and 20 minut…
After months of controversy and vandalism, the Bandera, Texas city council voted 3-2 to end its contract with Flock, a company providing AI-powered license plate reader cameras. In response, dissenting councilmember Jeff…
The article proposes a new vulnerability severity model based on "collision count," where bugs reported by multiple researchers or accompanied by working exploits receive higher severity and shorter patch windows. It ack…
The article highlights that while AI is increasingly used to both find security vulnerabilities and conduct cyberattacks, companies continue to make basic cybersecurity mistakes, such as leaving sensitive data publicly e…
Engineering behind TitleTrust, an AI-powered land fraud detection system built for Kenya to combat systematic land theft, including "air supply" scams where non-existent plots are sold. The system uses Google Gemini 3 Pr…
A BBC investigation found that AI chatbots like ChatGPT and Google's Gemini can be easily manipulated to spread misinformation by publishing a single, well-crafted blog post online. In response, Google has updated its po…
Phase 2 of the .NET AI Architect Laboratory project, where an autonomous AI agent was built using .NET 10, Google Vertex AI, and Microsoft Semantic Kernel to analyze local project files for security vulnerabilities and p…
Pip 26.1 introduces dependency cooldowns, which enforce a waiting period before freshly published packages can be installed, and experimental support for `pylock.toml` lockfiles from PEP 751. The cooldown feature aims to…