Ghostunnel: Open-source TLS proxy with mutual authentication 2026-11-04 at 08:30 By Anamarija Pogorelec Ghostunnel is an open-source proxy that handles TLS for programs that cannot handle it themselves. It works in two directions. In server mode it sits in front of a backend, accepts TLS connections, checks the client’s certificate, then passes traffic to the […]
Ghostunnel: Open-source TLS proxy with mutual authentication Read More »
Anthropic open-sources FlashProve, its provable inference prototype for MoE models 2026-11-04 at 06:36 By Anamarija Pogorelec Anthropic’s Frontier Red Team, with collaborators at EPFL, MIT and StarkWare, built FlashProve, a prototype that produces a cryptographic proof that one specific language model generated one specific reply. The prover, two verifiers, the formal proofs behind them and […]
Anthropic open-sources FlashProve, its provable inference prototype for MoE models Read More »
DeepSeek open-sources Super-Agent, a coding agent that watches team chats for work 2026-11-02 at 09:09 By Anamarija Pogorelec Deepseek released a research prototype of dsh-superagent, a coding agent that does work on a GitHub repository for you. Who can ask for work The agent gets to work in two situations: an allowed user asks for […]
DeepSeek open-sources Super-Agent, a coding agent that watches team chats for work Read More »
Byoky: Open-source wallet for AI API keys 2026-11-02 at 08:00 By Anamarija Pogorelec Byoky is an open-source wallet for AI API keys, available as a Chrome and Firefox extension and as iOS and Android apps. Users store their keys for OpenAI, Anthropic, Google Gemini and other providers in it, encrypted on their own device. Apps […]
Byoky: Open-source wallet for AI API keys Read More »
GitHub’s npm package firewall can block brand-new versions before they install 2026-10-28 at 19:09 By Mirko Zorz GitHub announced a package firewall that checks npm packages against an enterprise’s policy before they install. It blocks known malware, critical vulnerabilities, and brand-new versions, and any developer can turn it on by pointing npm at the firewall. […]
GitHub’s npm package firewall can block brand-new versions before they install Read More »
CISA updates ScubaGear and ScubaGoggles, and says Microsoft 365 checks get faster 2026-10-28 at 11:38 By Mirko Zorz CISA released ScubaGear v2.0 and ScubaGoggles v1.1.0, new versions of the open-source tools it publishes to check Microsoft 365 and Google Workspace settings against its security baselines. The agency calls ScubaGear v2.0 the most comprehensive update to […]
CISA updates ScubaGear and ScubaGoggles, and says Microsoft 365 checks get faster Read More »
AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records 2026-10-28 at 08:00 By Anamarija Pogorelec AbuseBox is a free, open-source tool that checks IP addresses and domains against 60 DNS blacklists, pulls reputation scores from AbuseIPDB, inspects DNS, SSL and email-authentication records, and sends an alert when something changes. A DNS blacklist, or DNSBL, […]
AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records Read More »
Private repos still leak secrets to Gheist, a stolen GitHub token campaign 2026-10-27 at 12:58 By Mirko Zorz Wiz Research has recovered more than 13,500 planted branches from 850+ compromised GitHub accounts, the work of a campaign it calls Gheist, after the user agent the tool sends with its GitHub API requests. The tool takes […]
Private repos still leak secrets to Gheist, a stolen GitHub token campaign Read More »
Witness: Open-source framework for verifying how your software was built 2026-10-26 at 09:00 By Anamarija Pogorelec Witness is an open-source command-line tool that records how software gets built, signs that record, and checks it against a policy before the software ships. TestifySec built Witness and donated it to the in-toto ecosystem within the Cloud Native […]
Witness: Open-source framework for verifying how your software was built Read More »
New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 2026-10-22 at 15:03 By Mirko Zorz Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on October 21. PHP2Shell lets an attacker reach pre-auth RCE against PHP […]
New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 Read More »
Info-stealing malware slipped into OVHcloud CLI releases on GitHub 2026-10-21 at 11:59 By Sinisa Markovic OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread information-stealing malware. OVHcloud CEO Octave Klaba disclosed the incident on X, warning users who downloaded the […]
Info-stealing malware slipped into OVHcloud CLI releases on GitHub Read More »
DevGuard: Open-source vulnerability management for the software supply chain 2026-10-21 at 10:02 By Anamarija Pogorelec DevGuard is a free, open source vulnerability management platform that collects a software project’s security findings in one place, ranks them by risk, and tracks them. It’s an OWASP Incubating Project, and anyone can self-host it. One command line, six […]
DevGuard: Open-source vulnerability management for the software supply chain Read More »
Google open-sourced TorchTPU, so PyTorch on TPUs just got a lot easier 2026-10-21 at 06:42 By Anamarija Pogorelec Google released TorchTPU as open source, giving PyTorch developers a native way to run models on the company’s Tensor Processing Units. Google also announced TPU support in the vLLM and SGLang serving engines, the TorchTitan training framework, […]
Google open-sourced TorchTPU, so PyTorch on TPUs just got a lot easier Read More »
Bearer CLI: Free, source-available code security scanning tool (SAST) 2026-10-19 at 08:30 By Anamarija Pogorelec Bearer CLI is a free static application security testing (SAST) tool that scans source code for vulnerabilities and prioritizes them by the sensitive data they touch. SAST means the tool reads code without running it. Organizations can use it freely, […]
Bearer CLI: Free, source-available code security scanning tool (SAST) Read More »
GitHub adopts cheaper AI model to catch secrets developers leave in code 2026-10-14 at 12:26 By Anamarija Pogorelec GitHub has trained a credential classifier to improve generic secret detection and reduce false alerts. The new pipeline cut median post-push scan execution time by 86% and model serving costs by more than 98% compared with its […]
GitHub adopts cheaper AI model to catch secrets developers leave in code Read More »
Meshery: Open-source cloud-native manager for Kubernetes 2026-10-14 at 08:00 By Anamarija Pogorelec Meshery is an open-source tool for designing, deploying and managing Kubernetes infrastructure, built by Layer5 and its community and hosted as a Cloud Native Computing Foundation project. Teams use it to lay out clusters and applications on a visual canvas, check the design, […]
Meshery: Open-source cloud-native manager for Kubernetes Read More »
Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach 2026-10-13 at 19:01 By Eduard Kovacs Most of the affected individuals are Meta employees in the United States and they are being offered credit monitoring services. The post Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach appeared first on […]
Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach Read More »
npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover 2026-10-13 at 12:00 By Mirko Zorz Bloom Security researchers found that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential. The attacker only needed to register a GitHub repository name the maintainer had left behind. Bloom […]
npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover Read More »
Strands Box: Open-source sandbox for AI agents 2026-10-12 at 08:30 By Mirko Zorz AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it act again. Box is in developer preview and runs on Macs with Apple […]
Strands Box: Open-source sandbox for AI agents Read More »
Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers 2026-10-08 at 13:24 By Sinisa Markovic Thousands of hijacked servers have been looking up their command and control (C2) server in a poem posted on GitHub, according to Black Lotus Labs. The malware reading it, dubbed PoeLLM, breaks into exposed AI services and […]
Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers Read More »