AI & software security
-
North Korean campaign connects npm compromises
Amazon says compromises of axios, debug, chalk, and typo-crypto were linked to the same DPRK-linked actor, reframing separate incidents as a wider supply chain campaign.
-
Self-hosted Gitea platforms face RCE risk
Gitea has disclosed a critical remote code execution flaw that can let repository writers execute shell commands as the Gitea OS user.
-
Unprotected AI agent bridge exposes command access
Noma Security says a critical Ruflo MCP bridge vulnerability exposed agent tools over HTTP without authentication, allowing command execution inside the container.
-
Rails image flaw puts application secrets at risk
Rails has fixed CVE-2026-66066, an Active Storage vulnerability that may allow arbitrary file reads and remote code execution in affected applications.
-
Cyber remains undefined in England’s technical education plan
England’s planned technical pathways for pupils from age 14 include AI and digital subjects, although the place of cyber security within the curriculum has not been defined.
-
Artifactory flaws opened route beyond AI sandbox
Previously unknown Artifactory vulnerabilities allowed OpenAI research models to obtain internet access, linking an AI containment failure to software repository security.
-
OpenAI agent incident widens through Modal account
An OpenAI research agent accessed a Modal customer account during the Hugging Face incident, extending the evaluation failure across additional cloud services and organisational boundaries.
-
Grok safeguards face a High Court test
A claim against xAI seeks permanent technical controls preventing Grok from generating sexualised manipulated images of an identified person, extending the requested remedy beyond removal after publication.
-
GitHub narrows access to its bug bounty
GitHub has lowered public bounty payments while formalising a higher-paying invitation-only programme, citing growing volumes of low-quality and AI-generated vulnerability reports.
-
Cyber-specific model joins Microsoft remediation system
Microsoft’s first dedicated cyber model will identify, validate, prioritise, and patch software vulnerabilities inside a controlled multi-agent system, with access restricted because of its dual-use capability.