GitHub

Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched

agentic AI, AI, Claude Code, Don't miss, GitHub, Hot stuff, News, vulnerability /

Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched 2026-09-18 at 11:49 By Sinisa Markovic Four major AI coding agents, Claude Code, Codex, GitHub Copilot and Gemini CLI, all share the same zero-click RCE vulnerability, one that could give an attacker the same reach into a company’s systems and data as the […]

Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched Read More »

Hardcoded MCP credentials found in public GitHub files

agentic AI, AI, credentials, cybersecurity, GitHub, identity protection, News, Non Human Identities /

Hardcoded MCP credentials found in public GitHub files 2026-09-18 at 08:30 By Anamarija Pogorelec Hardcoded API keys, access tokens and other credentials used by AI coding tools have been found in publicly accessible MCP configuration files on GitHub, according to research from Hush Security’s The State of MCP Configuration: The Identity Security Gaps report. The […]

Hardcoded MCP credentials found in public GitHub files Read More »

DeepZero: Open-source hunting for vulnerable Windows drivers

Don't miss, drivers, GitHub, News, open source, scanner, software, Windows /

DeepZero: Open-source hunting for vulnerable Windows drivers 2026-09-16 at 08:30 By Mirko Zorz DeepZero is an open-source engine that automates the search for exploitable Windows kernel drivers. You point it at a folder of binaries and it parses them, pulls them apart, scans them, throws most of them away, and asks a language model whether […]

DeepZero: Open-source hunting for vulnerable Windows drivers Read More »

Permify: Open-source authorization as a service

DevSecOps, Don't miss, GitHub, News, open source, software /

Permify: Open-source authorization as a service 2026-09-14 at 08:30 By Sinisa Markovic Permify is an open-source authorization service that answers access questions at run time: can user X view document Y, which posts can members of team Y edit. It keeps those rules in one place, apart from the application code that would otherwise carry […]

Permify: Open-source authorization as a service Read More »

AI-Infra-Guard: Open-source security scanner for AI systems

AI, Don't miss, GitHub, Hot stuff, LLMs, News, open source, red team, scanner, software, Tencent /

AI-Infra-Guard: Open-source security scanner for AI systems 2026-09-09 at 10:13 By Mirko Zorz Tencent’s Zhuque Lab built AI-Infra-Guard, an open-source security scanner for AI systems. It fingerprints running services such as Ollama, vLLM and ComfyUI and checks them against more than 1,600 known CVEs, inspects MCP servers and agent skills across 14 categories of risk, […]

AI-Infra-Guard: Open-source security scanner for AI systems Read More »

ToolHive: The open-source way to run any MCP server securely

AI, GitHub, News, open source, software /

ToolHive: The open-source way to run any MCP server securely 2026-09-07 at 08:30 By Anamarija Pogorelec ToolHive is an open-source platform that runs Model Context Protocol servers inside containers. An MCP server is the connector that lets an AI client like Cursor or Claude Code reach an outside tool, and Stacklok ships ToolHive under Apache […]

ToolHive: The open-source way to run any MCP server securely Read More »

Your threat feed is someone else’s database: What ingesting malware intel at scale takes

cybersecurity, DevSecOps, Don't miss, Expert analysis, GitHub, Hot stuff, News, opinion, Threat Intelligence /

Your threat feed is someone else’s database: What ingesting malware intel at scale takes 2026-09-03 at 08:30 By Help Net Security The advice is to consume shared threat intelligence. Join the ISAC. Wire the community feeds into your pipeline. This looks like a fine advice and I agree to it. What nobody mentions you is […]

Your threat feed is someone else’s database: What ingesting malware intel at scale takes Read More »

Open-source secrets scanning tool Sift hunts credentials in Microsoft 365, Slack, and Jira

Don't miss, GitHub, News, open source, penetration testing, software /

Open-source secrets scanning tool Sift hunts credentials in Microsoft 365, Slack, and Jira 2026-09-02 at 08:00 By Mirko Zorz Sift is a free, open-source command line tool that searches for passwords, API keys, and other sensitive data across the places a company keeps its work: local disks, Windows file shares, an entire Active Directory domain, […]

Open-source secrets scanning tool Sift hunts credentials in Microsoft 365, Slack, and Jira Read More »

Fake Claude Opus 5 app delivers malware and wipes its own tracks

Anthropic, Claude Code, GitHub, Malware, Morphisec, News /

Fake Claude Opus 5 app delivers malware and wipes its own tracks 2026-09-01 at 15:21 By Sinisa Markovic A malicious GitHub repository impersonating Anthropic and claiming to offer free access to “Claude Opus 5” is delivering RevStealer, Windows information-stealing malware that targets passwords, cryptocurrency wallet data and login credentials, according to Morphisec. Repository README using […]

Fake Claude Opus 5 app delivers malware and wipes its own tracks Read More »

Bot detection arrives in CrowdSec 1.8.0, along with two DoS fixes

GitHub, News, open source, software /

Bot detection arrives in CrowdSec 1.8.0, along with two DoS fixes 2026-09-01 at 08:04 By Anamarija Pogorelec Failed SSH logins pile up in an auth log, and a scanner walks a website looking for exposed admin paths. CrowdSec reads log sources and HTTP requests, works out which addresses are misbehaving, and hands the block to […]

Bot detection arrives in CrowdSec 1.8.0, along with two DoS fixes Read More »

Halo-record: Open-source audit trails for AI agents

agentic AI, Don't miss, GitHub, News, open source, software /

Halo-record: Open-source audit trails for AI agents 2026-08-31 at 08:30 By Mirko Zorz Brian Kuan wrote halo-record, a small Python package that sits inside an AI agent and writes down the moves it makes: tool calls, model calls, data access, approvals. Each action becomes one line in a file that only ever gets appended to, […]

Halo-record: Open-source audit trails for AI agents Read More »

Hazmat: Open-source containment for AI agents

agentic AI, cybersecurity, Don't miss, GitHub, Hot stuff, News, open source, penetration testing, software /

Hazmat: Open-source containment for AI agents 2026-08-17 at 08:00 By Anamarija Pogorelec Hazmat is an open-source tool that runs AI coding agents inside a separate account on your own machine. It wraps the harnesses people use: Claude Code, Codex, OpenCode, Cursor Agent, and several more, plus any script you write yourself. An agent launched the […]

Hazmat: Open-source containment for AI agents Read More »

PentestGPT: Open-source automated penetration testing agentic framework

agentic AI, Claude Code, cybersecurity, Don't miss, GitHub, LLMs, News, open source, penetration testing /

PentestGPT: Open-source automated penetration testing agentic framework 2026-08-12 at 08:30 By Anamarija Pogorelec PentestGPT is an open-source penetration testing agent that points a large language model at a target and lets it work. In its default mode it runs recon, then exploit, then walkthrough, each stage feeding the next. Switch it to pentest mode and […]

PentestGPT: Open-source automated penetration testing agentic framework Read More »

GitHub Dependabot malware alerts now cover eight ecosystems

DevSecOps, GitHub, News, open source, supply chain /

GitHub Dependabot malware alerts now cover eight ecosystems 2026-08-10 at 10:01 By Mirko Zorz GitHub has flagged npm malware since March 2026. Anyone pulling in a bad PyPI, Maven, RubyGems, NuGet, Go, crates.io, or PHP Composer package has had no such warning, because GitHub’s malware detection only ever watched one ecosystem. That changed this month. […]

GitHub Dependabot malware alerts now cover eight ecosystems Read More »

Chainloop: Open-source evidence store and policy engine for the software supply chain

Application Security, devsec, Don't miss, GitHub, News, open source, software, supply chain /

Chainloop: Open-source evidence store and policy engine for the software supply chain 2026-08-10 at 08:30 By Sinisa Markovic Chainloop is an open source evidence store for the software supply chain. A command line tool runs inside a GitHub Actions, GitLab, Jenkins, or Dagger pipeline, picks up what the build produced, uploads those files to content-addressable […]

Chainloop: Open-source evidence store and policy engine for the software supply chain Read More »

Future AGI: Open-source platform for shipping self-improving AI agents

agentic AI, AI, Don't miss, GitHub, Hot stuff, LLMs, News, open source /

Future AGI: Open-source platform for shipping self-improving AI agents 2026-08-05 at 08:30 By Anamarija Pogorelec Future AGI is an open-source platform for tracing, evaluating, simulating, and guardrailing LLM agents, licensed Apache 2.0 and self-hostable. Self-hosted instances register with Future AGI on first boot and send an instance ID, a version string, a deployment type, and […]

Future AGI: Open-source platform for shipping self-improving AI agents Read More »

AI developers targeted via trojanized GitHub repositories

AI, GitHub, Malware, Netskope, News /

AI developers targeted via trojanized GitHub repositories 2026-08-04 at 17:10 By Sinisa Markovic Cybercriminals are cloning popular GitHub repositories for AI tools and developer resources to distribute an infostealer, according to Netskope Threat Labs. (Source: Netskope) Netskope came across the campaign while tracking a Windows-based MaaS infostealer, first reported in April 2026, that was spread […]

AI developers targeted via trojanized GitHub repositories Read More »

Microsoft shortens NuGet API key lifetime to improve supply chain security

API security, GitHub, Microsoft, News, software development /

Microsoft shortens NuGet API key lifetime to improve supply chain security 2026-08-04 at 11:30 By Anamarija Pogorelec Microsoft is reducing the lifetime of new NuGet.org API keys from 365 days to 30 days starting August 17, 2026, to improve the security of NuGet, its package repository for .NET developers. API keys created before August 17 […]

Microsoft shortens NuGet API key lifetime to improve supply chain security Read More »

OWASP’s subtractive security project measures the attack paths you erased

CISO, cybersecurity, Don't miss, Features, GitHub, Hot stuff, News, open source, OWASP /

OWASP’s subtractive security project measures the attack paths you erased 2026-08-04 at 08:30 By Mirko Zorz An attacker who talks a user into opening an attachment gets whatever that machine still permits: a service account with rights across the domain, an outbound route to anywhere, a scripting engine sitting there for the taking. Christopher Frenz […]

OWASP’s subtractive security project measures the attack paths you erased Read More »

SkillSpector: NVIDIA’s open-source security scanner for AI agent skills

agentic AI, Don't miss, GitHub, Hot stuff, LLMs, News, NVIDIA, open source, scanner, software /

SkillSpector: NVIDIA’s open-source security scanner for AI agent skills 2026-08-03 at 08:30 By Anamarija Pogorelec SkillSpector is an open-source scanner from NVIDIA that reads an agent skill and tells you whether to install it. Point it at a directory, a zip file, a single SKILL.md, or a Git URL, and it returns a list of […]

SkillSpector: NVIDIA’s open-source security scanner for AI agent skills Read More »

Scroll to Top