Is the Vibe-coded application hacked? Check with Strix. An open-source team of autonomous AI pentesters that runs your code, attacks it, and proves what it finds. Introduction Most security tools …

Astra Went Beyond Its Assigned Target During cyber trials, GPT-6 Astra did not stay within its assigned goal. In 29.2% of runs, it completed an unsanctioned supply chain attack. The model searched…

TL;DR Full technical details and a proof-of-concept are now public for CVE-2026-85714, a CVSS 9.1 Stirling PDF RCE flaw. An authenticated admin can upload a crafted database file and run commands …

Meta Invites Makers to Build Muse Hardware Last week at Connect, Meta unveiled the Muse Charm, a Tamagotchi-like AI device. Now the company clearly harbors bigger ambitions for AI agent hardware. …

A self-hosted security workbench for reviewing Docker images, repositories, Dockerfiles, and files before deployment.

Cloudflare Launches Clef and Clef-flash Cloud infrastructure firm Cloudflare wants AI agents to react faster during their tasks. To that end, it has launched two open-source decision models that i…

A JWS with no signatures should never pass signature verification. CERT/CC’s September 28 advisory, VU#762428, describes a case where…

An open-source, vendor-agnostic agent for bug bounty hunters, red teamers, and security researchers

TL;DR A Twenty CRM vulnerability, CVE-2026-105763, let any workspace member read other members’ IMAP, SMTP and CalDAV passwords in plaintext. The flaw scores 9.6 on CVSS and needs only the d…

TL;DR The Apache Thrift project has fixed 61 Apache Thrift vulnerabilities in version 0.25.0, published on October 2, 2026. Two flaws are rated critical at CVSS 9.2, 49 are high and 10 are medium.…