Bot detection arrives in CrowdSec 1.8.0, along with two DoS fixes 2026-09-01 at 08:04 By Anamarija Pogorelec Failed SSH logins pile up in an auth log, and a scanner walks a website looking for exposed admin paths. CrowdSec reads log sources and HTTP requests, works out which addresses are misbehaving, and hands the block to […]
Bot detection arrives in CrowdSec 1.8.0, along with two DoS fixes Read More »
Halo-record: Open-source audit trails for AI agents 2026-08-31 at 08:30 By Mirko Zorz Brian Kuan wrote halo-record, a small Python package that sits inside an AI agent and writes down the moves it makes: tool calls, model calls, data access, approvals. Each action becomes one line in a file that only ever gets appended to, […]
Halo-record: Open-source audit trails for AI agents Read More »
Hazmat: Open-source containment for AI agents 2026-08-17 at 08:00 By Anamarija Pogorelec Hazmat is an open-source tool that runs AI coding agents inside a separate account on your own machine. It wraps the harnesses people use: Claude Code, Codex, OpenCode, Cursor Agent, and several more, plus any script you write yourself. An agent launched the […]
Hazmat: Open-source containment for AI agents Read More »
PentestGPT: Open-source automated penetration testing agentic framework 2026-08-12 at 08:30 By Anamarija Pogorelec PentestGPT is an open-source penetration testing agent that points a large language model at a target and lets it work. In its default mode it runs recon, then exploit, then walkthrough, each stage feeding the next. Switch it to pentest mode and […]
PentestGPT: Open-source automated penetration testing agentic framework Read More »
GitHub Dependabot malware alerts now cover eight ecosystems 2026-08-10 at 10:01 By Mirko Zorz GitHub has flagged npm malware since March 2026. Anyone pulling in a bad PyPI, Maven, RubyGems, NuGet, Go, crates.io, or PHP Composer package has had no such warning, because GitHub’s malware detection only ever watched one ecosystem. That changed this month. […]
GitHub Dependabot malware alerts now cover eight ecosystems Read More »
Chainloop: Open-source evidence store and policy engine for the software supply chain 2026-08-10 at 08:30 By Sinisa Markovic Chainloop is an open source evidence store for the software supply chain. A command line tool runs inside a GitHub Actions, GitLab, Jenkins, or Dagger pipeline, picks up what the build produced, uploads those files to content-addressable […]
Chainloop: Open-source evidence store and policy engine for the software supply chain Read More »
Future AGI: Open-source platform for shipping self-improving AI agents 2026-08-05 at 08:30 By Anamarija Pogorelec Future AGI is an open-source platform for tracing, evaluating, simulating, and guardrailing LLM agents, licensed Apache 2.0 and self-hostable. Self-hosted instances register with Future AGI on first boot and send an instance ID, a version string, a deployment type, and […]
Future AGI: Open-source platform for shipping self-improving AI agents Read More »
AI developers targeted via trojanized GitHub repositories 2026-08-04 at 17:10 By Sinisa Markovic Cybercriminals are cloning popular GitHub repositories for AI tools and developer resources to distribute an infostealer, according to Netskope Threat Labs. (Source: Netskope) Netskope came across the campaign while tracking a Windows-based MaaS infostealer, first reported in April 2026, that was spread […]
AI developers targeted via trojanized GitHub repositories Read More »
Microsoft shortens NuGet API key lifetime to improve supply chain security 2026-08-04 at 11:30 By Anamarija Pogorelec Microsoft is reducing the lifetime of new NuGet.org API keys from 365 days to 30 days starting August 17, 2026, to improve the security of NuGet, its package repository for .NET developers. API keys created before August 17 […]
Microsoft shortens NuGet API key lifetime to improve supply chain security Read More »
OWASP’s subtractive security project measures the attack paths you erased 2026-08-04 at 08:30 By Mirko Zorz An attacker who talks a user into opening an attachment gets whatever that machine still permits: a service account with rights across the domain, an outbound route to anywhere, a scripting engine sitting there for the taking. Christopher Frenz […]
OWASP’s subtractive security project measures the attack paths you erased Read More »
SkillSpector: NVIDIA’s open-source security scanner for AI agent skills 2026-08-03 at 08:30 By Anamarija Pogorelec SkillSpector is an open-source scanner from NVIDIA that reads an agent skill and tells you whether to install it. Point it at a directory, a zip file, a single SKILL.md, or a Git URL, and it returns a list of […]
SkillSpector: NVIDIA’s open-source security scanner for AI agent skills Read More »
New GitHub, PyPI Policies Boost Supply Chain Security 2026-07-27 at 17:26 By Ionut Arghire Dependabot gets a three-day cooldown window before opening pull requests, and PyPI rejects file uploads to releases older than 14 days. The post New GitHub, PyPI Policies Boost Supply Chain Security appeared first on SecurityWeek. This article is an excerpt from […]
New GitHub, PyPI Policies Boost Supply Chain Security Read More »
GitHub revamps bug bounty program with new VIP tier, payout changes 2026-07-23 at 11:35 By Anamarija Pogorelec GitHub is changing its bug bounty program to reward higher-quality vulnerability reports and reduce low-effort submissions, including AI-generated reports. The changes will take effect on July 27, 2026. Reports submitted before that date will be honored under the […]
GitHub revamps bug bounty program with new VIP tier, payout changes Read More »
Small teams are the heaviest users of AI coding agents 2026-07-22 at 09:00 By Sinisa Markovic The pull request arrives with the tests already run and the description already written, the work of an agent that handled the whole thing on its own. Somebody still has to read it. On GitHub that somebody is usually […]
Small teams are the heaviest users of AI coding agents Read More »
Snowpick: Open-source ServiceNow exposure scanner 2026-07-22 at 08:30 By Mirko Zorz An employee opens a company service portal, searches the knowledge base, and drops a file onto a ticket. Someone who never signed in can send a request to that same portal and get records back. Bishop Fox ran that test across 166 ServiceNow instances […]
Snowpick: Open-source ServiceNow exposure scanner Read More »
AI agents tricked into recommending malicious GitHub repositories 2026-07-21 at 17:27 By Sinisa Markovic Roughly 7,600 malicious GitHub repositories were uncovered, more than 800 of them posing as AI Skills or Model Context Protocol (MCP) servers, in a wave that peaked in April 2026, according to Island. The scale of the FakeGit operation (Source: Island) […]
AI agents tricked into recommending malicious GitHub repositories Read More »
Open-source maintainers still work underfunded as sponsorship crosses $100 million 2026-07-21 at 11:37 By Anamarija Pogorelec A maintainer patches a library late at night that ships inside thousands of products, and no invoice follows. Sebastián Ramírez and Caleb Porzio spent years in that position. Ramírez, known as tiangolo, builds tools that other Python projects depend […]
Open-source maintainers still work underfunded as sponsorship crosses $100 million Read More »
Meet Dusseldorf, Microsoft’s open-source out-of-band security platform 2026-07-20 at 09:00 By Anamarija Pogorelec Out-of-band vulnerabilities surface when an application quietly reaches out to an external system during an attack, and capturing that traffic calls for infrastructure that many researchers assemble on their own. A new open-source project from Microsoft supplies that infrastructure in a package […]
Meet Dusseldorf, Microsoft’s open-source out-of-band security platform Read More »
VS Code agent host runs Copilot, Claude, and Codex in a dedicated process 2026-07-16 at 10:45 By Anamarija Pogorelec Developers who lean on AI coding agents often keep several editor windows open at once, each tied to its own session. The 1.129 release of Visual Studio Code reworks that setup with a dedicated agent host. […]
VS Code agent host runs Copilot, Claude, and Codex in a dedicated process Read More »
Threat actor impersonated hundreds of brands on GitHub to push infostealer malware 2026-07-15 at 16:52 By Zeljka Zorz A financially motivated threat actor is impersonating hundreds of brands on GitHub and pushing a smash-and-grab infostealer masquerading as legitimate downloads of popular software, Arctic Wolf threat researchers have warned. “The 292 impersonated repositories span security tooling, […]
Threat actor impersonated hundreds of brands on GitHub to push infostealer malware Read More »