Browsing Tag
Open Source Security
13 posts
Open source software security and dependency risk
GitLab CVSS 10 RCE Spans 12 Years of Releases: Patch and Hunt Now
CVE-2026-110264 lets unauthenticated attackers run code on self-managed GitLab servers. Check fixed versions, upgrade traps and the evidence defenders should preserve.
Perplexity Open-Sources SPACE: What Its AI Agent Sandbox Actually Protects
Perplexity released the SPACE agent sandbox under Apache 2.0. Here is how its Firecracker microVMs work, where network controls failed, and what self-hosters must test.
Homebrew 7.0.0 Turns Mac Package Installs Into a Security Check
Homebrew 7.0.0 adds built-in vulnerability checks, a native BrewUI Mac app, stronger sandboxing, and several migration deadlines. For developers and Mac admins, the release turns package management into a security and inventory task.
Langflow Attacks Turn AI Workflow Servers Into Credential Targets
Attackers are actively exploiting Langflow flaws to pull OpenAI keys, AWS secrets, environment variables, and Langflow superuser credentials from exposed AI workflow servers. Teams running Langflow should treat patching as only the first step: credential rotation, log review, and network isolation matter just as much.
Tenable CyberAgents Exchange Turns Security Agents Into Shared Infrastructure
Tenable launched CyberAgents Exchange at Black Hat USA as a free, open-source registry for cybersecurity AI agents, skills, MCP servers, and playbooks. The useful idea is shared defense code; the hard part is proving each component is trustworthy enough to run inside real security operations.
Rails Active Storage Flaw Turns Image Uploads Into a Secret-Rotation Drill
Rails maintainers patched CVE-2026-66066, a critical Active Storage flaw that can let attackers turn image uploads into arbitrary file reads and possible remote code execution. For affected teams, the job is not only upgrading Rails and libvips, but checking exposure windows and rotating secrets that may have been readable by the Rails process.
curl 8.21.0 Fixes 25-Year-Old libcurl mTLS Bug
curl 8.21.0 fixes 18 security flaws, including CVE-2026-8932, a 25-year-old libcurl mTLS connection-reuse bug. The practical risk is in applications that embed libcurl and change client certificate settings while reusing connection pools.
OpenAI Daybreak Turns AI Bug Finding Into a Patching Race
OpenAI expanded Daybreak with Patch the Planet, an updated GPT-5.5-Cyber model, Codex Security workflows, and a partner program for vetted security vendors. The move shifts the AI cybersecurity race from finding more bugs to validating, patching, testing, and landing fixes before maintainers are overwhelmed.
Mastra npm Compromise Turns AI Agent Frameworks Into a Supply-Chain Target
Attackers republished more than 140 Mastra npm packages with a poisoned easy-day-js dependency, exposing AI agent developers to an install-time remote payload. Teams that installed affected @mastra packages on June 17 should treat developer machines and CI runners as compromised.
curl’s July Security Pause Shows AI Bug Reports Have a Human Bottleneck
The curl project will pause public vulnerability reports during July 2026 after months of AI-assisted security-report pressure. The break exposes a practical risk for companies that depend on critical open source software: finding bugs is getting faster than triage, patching, and maintainer capacity.