NVIDIA founder Jensen Huang recently announced a new coalition. Together with Microsoft and others, the company has formed the Open Secure AI Alliance. Its main goal is to raise the level of cyber…

TL;DR The OVSwrap local root flaw lets an unprivileged user gain root on many Linux systems. It affects the kernel’s Open vSwitch datapath and carries the ID CVE-2026-64531. Researcher Asim …

Inside the Open Source Platform That Turns Autonomous AI Teams Into Real Penetration Testers

TL;DR OpenDJ 5.1.2 fixes four security flaws in the open-source LDAP directory server. The two most severe OpenDJ vulnerabilities are a CVSS 9.6 authorization bypass and a CVSS 9.4 unauthenticated…

TL;DR OpenAM 16.1.2 patches four security flaws in the open-source access management server. Three of these OpenAM vulnerabilities lead to remote code execution. The worst, CVE-2026-62379, allows …

The Clash Between Safety Classifiers and Vulnerability Research Protective mechanisms in advanced AI models aim to hinder malicious actors. However, excessive safety restrictions can also halt leg…

How a seemingly harmless GraphQL query exposed private user history and highlighted the importance of authorization in nested resolvers.

A crash-test facility for the MCP ecosystem — and why the tools your AI agents rely on have never been properly tested

How an AI-driven breach exposed the dangerous limits of corporate guardrails.

Open Banking API security refers to the technologies, policies, and practices used to protect APIs that enable secure financial data…

A field guide · Part 1 of 6 — the view from base camp

At a glance Actor DPRK-linked group (Sapphire Sleet, Stardust Chollima, BlueNoroff, UNC1069) Activity NPM supply chain compromise via maintainer social engineering Targets Users of the axios, debu…

Subtitle: Everyone argued about Sol and Mythos. I wired tools and Skills into cheap models and got the same class of bugs on public code.

Far-right internet communities have begun transforming doxxing into a nearly automated process. Users of the anonymous imageboard Soyjak Party engineered several new applications. These instrument…

Reports of AI-driven agents autonomously discovering vulnerabilities and escaping their evaluation environments have become increasingly frequent – and they merit serious attention. The conc…

A modern, bilingual, glassmorphic Single Page Application designed for Pentesters, Security Researchers, and Developers.

A command injection that fires before any sandbox exists, a V8 isolate that protects the wrong half of your module, and an XSS in the OAuth…

When Short Links Betray You: Open Redirect via Deep Link Misconfiguration

When Short Links Betray You: Open Redirect via Deep Link Misconfiguration

Build an OAuth flow that authorizes a specific action, amount, recipient, and API — not an ambiguous category of access.