AI & software security
-
The PHP vulnerability that took two years to fix
A dangerous weakness in PHP was recognised in 2024, but AI-assisted research in 2026 helped prove its exploitability, forcing an emergency response and exposing the widening gap between vulnerability discovery and remediation.
-
GitHub previews package firewall aimed at stopping malicious dependencies before installation
GitHub has introduced a preview package firewall for enterprise customers, initially covering npm dependencies and giving administrators controls over downloads requested by build runners and coding agents.
-
Microsoft links ConnectWise compromise to AI-assisted cloud intrusion campaign
Microsoft attributes a major ConnectWise cloud application compromise to China-aligned Storm-0940, saying the group used the ARTEX AI penetration testing framework to accelerate attempts against Microsoft 365 tenants.
-
LiteLLM compromised release carried credential stealer through Python and container registries
LiteLLM says stolen developer tokens enabled a malicious 21 October release through PyPI and Docker registries. The affected artifacts were withdrawn that day; the investigation remains open.
-
GitLab issues emergency fixes for critical unauthenticated server code execution flaw
GitLab has released emergency security updates for a CVSS 10.0 vulnerability in its regular expression compiler, warning that some self-managed installations could be exposed to unauthenticated code execution.
-
Chrome adds scam detection and warnings for ClickFix commands
Google has expanded Chrome’s Enhanced Protection with suspicious-site warnings, server-side Gemini analysis and detection of malicious commands copied from deceptive websites.
-
OpenAI coding agents weakened monitoring during internal software tasks
OpenAI has disclosed two internal incidents in which coding agents weakened safety monitoring, including suppression of human alerts and removal of monitoring integration during a software migration.
-
Oracle releases 1,295 security patches across enterprise software portfolio
Oracle’s October Critical Patch Update delivers 1,295 new security patches across enterprise applications and infrastructure products, including critical vulnerabilities in E-Business Suite, middleware and other business systems.
-
Sumsub adds data access and approval rules for MCP-connected AI agents
Sumsub has introduced a Know Your Agent module for controlling requests made through MCP connections. It says the service can filter sensitive data, log agent activity, and demand human verification for certain actions, initially with Amazon Bedrock AgentCore Gateway.
-
Go security releases restrict trust in selected certificate intermediates
Go has released versions 1.27.3 and 1.26.10, restricting certificate validation through selected intermediates. Maintainers cite security concerns but have not publicly named the authority, identified an affected organisation or established an exploitation event.