Cybersecurity
Security fixes, CVEs and incidents in open source software.
16 stories • RSS feed
Most important in the last 30 days
- Researchers demonstrate backdoor attacks on open-weight AI models • Bruce Schneier Security Affairs • Impact 7/10
Modified open-weight models, such as abliterated versions, are vulnerable to low-cost supply-chain attacks where triggers can cause data exfiltration.
- Trail of Bits introduces SequenceHash for secure multihashing • Trail of Bits Engineering Blog • Impact 6/10
SequenceHash provides a hash-agnostic method for securely hashing multiple values together without the risks of simple concatenation.
- Suspect arrested in FBI data theft by ShinyHunters • Bruce Schneier Security Affairs • Impact 6/10
An individual associated with the ShinyHunters group has been arrested following the theft of FBI agent data.
- Trail of Bits study finds widespread integrity flaws in package managers • Trail of Bits Engineering Blog • Impact 6/10
A study of 25 popular package managers revealed that most fail to automatically verify package integrity via cryptographic hashes or signatures.
- Hackers target connected refrigeration units in France • Bruce Schneier Security Affairs • Impact 6/10
Attackers manipulated temperature regulation software in supermarket refrigeration units, causing temperatures to rise to 50C.
Latest stories
- Researchers build adaptive AI system that learns to solve new CAPTCHA types without retraining • Bruce Schneier Security Affairs • Impact 6/10
A system combining YOLOv8 with an open-weight vision-language model can solve visual CAPTCHAs and automatically learn new CAPTCHA categories from its own outputs, recovering even when defenders deliberately perturb images to break detection.
- SANS releases YARA rule to detect orphaned VBA projects in AutoCAD DWG files • SANS Internet Storm Center • Impact 5/10
The SANS Internet Storm Center published a YARA rule for detecting malicious orphaned VBA projects embedded in DWG files.
- GitHub expands Dependabot malware advisories to eight ecosystems via OpenSSF • OpenSSF Supply Chain Security • Impact 6/10
GitHub has integrated OpenSSF's malicious-packages data into its Advisory Database, bringing malware detection to PyPI, Maven, Go, and other major ecosystems.
- New study estimates cryptanalysis effort for public-key algorithms • Bruce Schneier Security Affairs • Impact 5/10
A new research project uses published literature to estimate the cumulative human-hours spent attacking various public-key cryptographic assumptions.
- Privateer joins OpenSSF Sandbox as AI-assisted security evaluation framework • OpenSSF Supply Chain Security • Impact 5/10
Privateer is a plugin-based framework that combines deterministic checks with optional LLM assistance to automate security and compliance evaluations.
- Google Project Zero outlines emergency patching strategies for vendors • Google Project Zero Research • Impact 5/10
Vendors can use feature flags and dynamic filtering to remediate urgent vulnerabilities faster than traditional update cycles.
- OpenSSF adds JetBrains and others to membership, releases CRA compliance resources • OpenSSF Supply Chain Security • Impact 5/10
OpenSSF has expanded its membership and released new guidance to help organizations comply with the EU Cyber Resilience Act (CRA).
- GitHub Security Lab finds 24 Android vulnerabilities using open source AI agent • GitHub Security Lab Advisories • Impact 5/10
GitHub Security Lab researchers used the open source Taskflow Agent to identify and report 24 vulnerabilities in Android applications.
- Trail of Bits warns of security risks when combining TEEs and MPC • Trail of Bits Engineering Blog • Impact 5/10
Using Trusted Execution Environments (TEEs) to run Multi-Party Computation (MPC) protocols can introduce new vulnerabilities, such as host-driven rollback attacks, if not implemented with defense-in-depth.
- GitHub Security Lab introduces autonomous AI fuzzing pipeline • GitHub Security Lab Advisories • Impact 5/10
A new autonomous pipeline uses LLM agents to automate the entire fuzzing process for C/C++ projects, from harness writing to crash triage.
- Google Project Zero releases MAccConc for Linux race condition testing • Google Project Zero Research • Impact 5/10
MAccConc is a new suite of tools designed to help developers identify and explore multi-threaded race conditions in the Linux kernel.