-
Witness: Open-source framework for verifying how your software was built
Witness is an open-source command-line tool that records how software gets built, signs that record, and checks it against a policy before …
-
AI slop is piling up highest on the biggest open-source projects
The maintainers of large open source projects are taking the worst of the AI slop. In a Linux Foundation survey of 234 open source …
-
Product showcase: Stellar Cyber’s ISOC platform provides full-cycle architecture
An AI SOC that starts with somebody else’s alert is already too late. Stellar Cyber collects and normalizes telemetry, detects suspicious …
-
Forgotten AI agents may still access sensitive company data
AI agents that have not run recently retain credentials and connections to company systems, according to Arrakis Security’s 2026 …
-
Synthetic identities leave US lenders with $2.4 billion in fraud exposure
Criminals are exploiting established customer accounts and familiar brands to steal money and personal information, according to …
-
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
In an update, Palo Alto Networks Unit 42 said it’s retracting its earlier assessment that the post-compromise activity targeting the …
-
Google open-sources the Elephant-Goldfish Model plugin its engineers use to catch AI coding mistakes
Google has open-sourced the Elephant-Goldfish Model plugin, an internal tool that makes an AI coding agent write and defend a design …
-
r/opensource bans AI projects, and solo devs go down with them
Moderators of r/opensource, Reddit’s catch-all forum for open source software, have barred any project that “uses AI, is made by AI, or …
-
Work to protect DNS from quantum decryption attacks is speeding up
Internet governance bodies are likely to accelerate work to prepare the domain name system (DNS) so it can remain secure once quantum …
-
OpenSSL 4.1.0: What’s new, what’s removed, and what’s still broken
The OpenSSL project released version 4.1.0, adding support for DTLS 1.3 and listing four known bugs in the DTLS code that ships with it. …
-
CVE-2026-116123 – A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the …
A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file …
-
CVE-2026-116122 – A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function …
A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in …
●●●
NVD
- CVE-2026-116100 – A vulnerability has been found in gougucms up to 4.08.18. Impacted is the function Add of …
- CVE-2026-116097 – A security vulnerability has been detected in CloudClassroom-PHP-Project. This affects an …
- CVE-2026-116098 – A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability …
- CVE-2026-116099 – A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to …
- CVE-2026-116123 – A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the …
EXPLOITS
- PHP2Shell (CVE-2026-109618) – PHP core versions after v5.4 – RCE
- Open eClass 3.15 – RCE
- Keycloak 26.7.2 – Unauthenticated Account Takeover
- South River Technologies Titan MFT Server 26.0.0 – code execution
- Synametrics Syncrify 6.2 – command execution
SECURELIST
- How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asi
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
- Operation FlashHole: Lazarus breaks security, defies control
- The journey of a paper unicorn: adventures inside a modern warehouse
- MacSync under the microscope: new delivery methods and a new payload