They aren't hacking your computer. They're Googling you better than you Google yourself — here's exactly how they do it.

Walter Gómez — Parte 2 de 2 — Laboratorio reproducido en Proxmox con Wazuh 4.14.8

A technical walkthrough of the open-source, code-aware AI pentester — its agent architecture, its “no exploit, no report” philosophy, how…

How a multi-agent system plans, executes, and remembers autonomous penetration tests inside an isolated sandbox

GitHub Tightens npm Trusted Publishing Rules GitHub has changed the rules for npm trusted publishing. A new configuration that does not complete its first successful publish within 48 hours will n…

By Ikram (@Ikram-4)

Meet AirTell: an open-source, LLM accelerated fork of NCCGroup's Sniffle unifying BLE 5 defense, counter-surveillance, and offensive sec.

Picture the desk in front of you right now…

TL;DR On October 16, 2026, Apache disclosed 12 Apache Kylin vulnerabilities, including a critical SQL injection flaw, CVE-2026-64959. Version 5.0.5 fixes all of them. Meanwhile, Apache Airflow pat…

OpenCode, the open-source coding agent, disclosed on October 17, 2026 that an intruder reached a legacy system on the night of October 16…

Kernel Maintainers Vote to Retire the Tag At the Linux Kernel Maintainers Summit on October 8, attendees agreed to scrap the Assisted-by tag in patches. On October 14, the related revert patch lan…

The GNOME Project Opens Its Own OS to Everyone The GNOME project has released a public GNOME OS preview. It ships with the GNOME 51.1 desktop. Most people meet GNOME through distributions such as …

FortProof is a free, open-source engine that judges every security control from evidence of what actually ran, never from what was…

A security patch can neutralize a vulnerability while simultaneously exposing a direct path to the next exploit. Recently, cybersecurity firm Terra Security investigated how security patches becam…

The open-source project cURL announced a significant restructuring of its triage workflow. Starting October 26, 2026, researchers must submit low and medium severity vulnerability reports directly…

Discovery got industrialized. Remediation didn’t.

A task-fit shortlist for binary reversing, source-led bounty work, and authorized API testing. I read the linked SKILL.md files; I have not…

A missing origin check in Storybook’s preview transport allowed a malicious website to send crafted messages to a running Storybook…

The free service can find vulnerabilities and suggest patches, but enrolled projects must be ready to validate the results themselves.

A security scanner can tell you that something looks suspicious.