Researchers have demonstrated an adaptive CAPTCHA solver that improves with use rather than treating each challenge as independent. The system routes tasks between a fine-tuned YOLOv8 detector and an open-weight VLM based on confidence, achieving 85.4% overall accuracy across 16 CAPTCHA classes. Crucially, VLM outputs serve as automatic training labels for the detector, allowing it to acquire new categories after one or two encounters without human annotation. The study also simulated a year-long arms race with monthly defensive perturbations; the solver recovered every round, with even a roughly 70%-accurate open-weight teacher proving sufficient to harden the detector.

SANS Internet Storm Center has shared a YARA rule designed to identify 'orphaned' VBA projects inside DWG files. These orphaned projects can be used as a vector for malware delivery through AutoCAD drawing files. The rule provides a detection mechanism for security teams monitoring file-based threats in engineering and design environments.

GitHub has expanded its malware advisory capabilities beyond npm by integrating the OpenSSF Malicious Packages repository. This integration allows Dependabot to alert developers about malicious packages across eight ecosystems, including PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. The move leverages a community-driven database of over 238,000 reports in the OSV format.

Security researcher Bruce Schneier reports that edited open-weight models—including fine-tunes, merged adapters, and abliterated builds—can be easily backdoored. In a proof-of-concept, researchers poisoned 1.5B and 7B parameter models to exfiltrate credentials when a specific trigger was met. The attack is difficult to detect because the model passes standard evaluations and behaves normally until the trigger is activated.

Researchers have launched a site that quantifies the amount of cryptanalytic work directed at different public-key algorithms. By analyzing approximately 16,000 candidate papers, the study converts academic publications into estimated research-allocation years. The findings indicate that lattice-based cryptanalysis has recently overtaken elliptic curve cryptanalysis in cumulative effort.

A cyberattack in France targeted the software controlling temperature regulation in supermarket refrigeration units. According to an affected supermarket chain, hackers forced some units to heat up to 50C overnight. Danfoss stated that the compromised units were older models with security software that could not be updated to mitigate identified risks.

A security analysis by Trail of Bits tested 25 major package managers against simulated malicious repositories. The findings show that fewer than half use lockfiles to check for tampering by default, and only two managers—Go and vcpkg—verify the integrity of every downloaded package. While HTTPS is widely used, many tools require manual configuration to enable critical cryptographic protections like signature verification or hash checking.

The OpenSSF has approved Privateer as a Sandbox project under the ORBIT Working Group. The framework is designed to evaluate software source code, repository configurations, and deployed systems against security control catalogs. It uses a hybrid approach, employing deterministic scanners first and using Large Language Models (LLMs) to review qualitative evidence like security policies that traditional tools cannot parse.

The FBI has arrested a suspect linked to a major data breach involving the theft of sensitive information about its own agents. The breach was claimed in September by the hacking group ShinyHunters, resulting in a significant intelligence loss for the agency.

Google Project Zero has released a research overview detailing how software vendors can accelerate the remediation of critical vulnerabilities. The report identifies testing and delivery as the primary bottlenecks in the patching process and suggests technical methods like feature flags and input filtering to bypass traditional update delays. These methods allow for rapid response without the high risk of 'bricking' devices through untested code.

During Community Day Europe, the Open Source Security Foundation (OpenSSF) announced new General Members, including JetBrains, A-Team Systems, Emphere, and DACHS IT GMBH. The foundation also released several resources focused on the EU Cyber Resilience Act (CRA), including a practitioner's guide and user journeys. Additionally, the OpenSSF Sandbox welcomed BOMHort, a Kubernetes-native SBOM visualization tool.

Trail of Bits has released SequenceHash and SequenceMAC, two new cryptographic constructions designed to solve the 'multihashing' problem. Unlike NIST's TupleHash, which is tied to Keccak, SequenceHash works with various functions like SHA256, BLAKE, and RIPEMD. The project aims to prevent security vulnerabilities like ambiguous input encoding and length-extension attacks in applications like zero-knowledge proofs.

GitHub Security Lab has demonstrated the effectiveness of its open source Taskflow Agent by discovering 24 vulnerabilities in Android applications. The researchers developed specialized auditing taskflows to guide LLMs through mobile-specific attack surfaces, such as intent-based entry points. These automated workflows help security researchers find complex vulnerabilities that standard models might miss.

Trail of Bits has published an analysis regarding the integration of Multi-Party Computation (MPC) within Trusted Execution Environments (TEEs). While TEEs can elevate semi-honest MPC protocols to provide malicious security guarantees through attestation, the untrusted host still controls critical operations like I/O and filesystem state. This can lead to attacks such as filesystem rollbacks that cause nonce reuse and private key exposure.

The GitHub Security Lab has released the Fuzzing Taskflow, an autonomous pipeline designed to automate security testing for C/C++ repositories. Built on the Taskflow Agent framework, the system identifies entry points, writes fuzzing harnesses, executes AFL++, analyzes coverage, and triages crashes. The tool is designed to reduce the manual workload typically required to maintain continuous fuzzing campaigns.

A researcher from Google Project Zero has released MAccConc (Memory Access Concurrency), a set of tools to explore thread interleavings in the Linux kernel. The suite includes an automated tool for A-B-A interleaving tests, a terminal UI, and a GUI for manual exploration. It leverages KASAN outline instrumentation and KCOV to trace memory accesses, aiming to improve bug confirmation, regression testing, and automated fuzzing.