vulnerability assessment

Most of the bugs Claude Mythos found have never been checked by a human

AI, cybersecurity, News, report, supply chain, vulnerability assessment /

Most of the bugs Claude Mythos found have never been checked by a human 2026-09-04 at 07:30 By Anamarija Pogorelec Anthropic pointed Claude Mythos Preview at 281 open-source projects and collected 23,019 candidate vulnerabilities. External security firms reviewed 1,900 of them. Maintainers received 1,596 reports and acknowledged 1,451; 97 fixes landed upstream, and 88 findings […]

Most of the bugs Claude Mythos found have never been checked by a human Read More »

Three in four AI-generated vulnerability patches leave something broken

1Password, agentic AI, AI, CVE, DevSecOps, Don't miss, Hot stuff, News, OpenAI, patching, research, Trail of Bits, vulnerability assessment /

Three in four AI-generated vulnerability patches leave something broken 2026-08-06 at 15:45 By Mirko Zorz Ask a frontier model to patch a real vulnerability and it will hand you something that looks like a fix. It reads like the patch a maintainer would write. When there is a test, it often passes. Roughly one time […]

Three in four AI-generated vulnerability patches leave something broken Read More »

Code review used to be the only way to catch these bugs

cybersecurity, Don't miss, fuzzing, News, Palo Alto Networks, research, vulnerability assessment /

Code review used to be the only way to catch these bugs 2026-08-05 at 14:30 By Mirko Zorz An automated system called NOVA read the source code of 3,915 open-source projects over two months and came back with 14,090 vulnerabilities, each one confirmed through the system’s validation pipeline. Vulnerability researchers at Palo Alto Networks’ Unit […]

Code review used to be the only way to catch these bugs Read More »

200 new CVEs a day and no realistic way to patch them all

CISA, cybersecurity, Don't miss, Features, Hot stuff, KEVIntel, News, opinion, patching, vulnerability assessment, vulnerability management /

200 new CVEs a day and no realistic way to patch them all 2026-07-30 at 09:00 By Mirko Zorz Ryan Dewhurst, CEO at KEVIntel, explains how his team confirms exploitation that CISA’s catalog has not listed yet. He describes a global honeypot sensor network, AI triage, and human verification in a lab before a vulnerability […]

200 new CVEs a day and no realistic way to patch them all Read More »

The AI code vulnerabilities that grow with your app

AI, automation, code analysis, cybersecurity, DevSecOps, Don't miss, News, report, Theori, vulnerability assessment /

The AI code vulnerabilities that grow with your app 2026-07-23 at 07:30 By Mirko Zorz Theori built 28 apps with AI coding agents and scanned each one through its pentesting platform. Five models did the building, split between Anthropic and OpenAI, across apps written from a spec, thrown together from a casual prompt, and rewritten […]

The AI code vulnerabilities that grow with your app Read More »

20 open-source cybersecurity tools to keep your team ready for anything

agentic AI, AI, Application Security, containers, cybersecurity, Don't miss, Endpoint Security, Exabeam, firewall, GitHub, Hot stuff, LLMs, Microsoft, News, open source, OWASP, penetration testing, scanner, security telemetry, software, vulnerability assessment, Windows /

20 open-source cybersecurity tools to keep your team ready for anything 2026-07-08 at 08:30 By Anamarija Pogorelec AI is changing how security teams find vulnerabilities, analyze code, test applications, and protect infrastructure. Developers are building tools to secure AI systems themselves, from coding agents and memory protection to model exposure discovery. This roundup covers recent […]

20 open-source cybersecurity tools to keep your team ready for anything Read More »

Vulnerability reports are arriving faster than GitHub can review them

CVE, DevOps, Don't miss, GitHub, News, vulnerability assessment, vulnerability management /

Vulnerability reports are arriving faster than GitHub can review them 2026-06-30 at 08:25 By Anamarija Pogorelec Across the open source world, people are reporting software flaws in record numbers, and the systems built to verify those reports are straining under the weight. The GitHub Advisory Database, which feeds automated security alerts to millions of projects, […]

Vulnerability reports are arriving faster than GitHub can review them Read More »

Vigolium: Open-source vulnerability scanner

Don't miss, GitHub, News, open source, scanner, software, vulnerability assessment /

Vigolium: Open-source vulnerability scanner 2026-05-27 at 09:24 By Anamarija Pogorelec Vigolium, an open-source vulnerability scanner that combines deterministic scanning with AI-driven auditing, launched its initial open-source release this month. The project ships 235+ scanner modules and an in-process agent runtime called olium that handles autonomous endpoint discovery, attack planning, and finding triage. The tool exposes […]

Vigolium: Open-source vulnerability scanner Read More »

Cisco refines its risk-based vulnerability disclosure for the AI era

AI, Cisco, cybersecurity, News, vulnerability assessment /

Cisco refines its risk-based vulnerability disclosure for the AI era 2026-05-25 at 21:27 By Sinisa Markovic Security teams already struggle with long lists of vulnerabilities and limited time to patch them. Cisco believes AI could increase that pressure by accelerating vulnerability discovery and increasing the number of findings security teams need to review. The company […]

Cisco refines its risk-based vulnerability disclosure for the AI era Read More »

CVE Lite CLI: Open-source dependency vulnerability scanner

Don't miss, GitHub, News, open source, OWASP, scanner, software, software development, vulnerability assessment /

CVE Lite CLI: Open-source dependency vulnerability scanner 2026-05-20 at 09:34 By Mirko Zorz Dependency vulnerability scanning in JavaScript and TypeScript projects has long sat at the end of the development pipeline. Pull requests get opened, continuous integration runs, and a security scanner returns a list of CVE identifiers that developers then have to triage hours […]

CVE Lite CLI: Open-source dependency vulnerability scanner Read More »

AI is drowning software maintainers in junk security reports

AI, bug bounty, Don't miss, GitHub, Hot stuff, Linux, News, open source, vulnerability assessment, vulnerability disclosure /

AI is drowning software maintainers in junk security reports 2026-05-18 at 21:32 By Zeljka Zorz AI-assisted vulnerability research has exploded, unleashing a firehose of low-quality reports on overworked software maintainers who are wasting hours sifting through noise instead of fixing real problems. Linus Torvalds, the Linux kernel’s creator, says the flood has made the project’s […]

AI is drowning software maintainers in junk security reports Read More »

NIST admits defeat on NVD backlog, will enrich only highest-risk CVEs going forward

CVE, Don't miss, ENISA, Hot stuff, News, NIST, vulnerability assessment, vulnerability management /

NIST admits defeat on NVD backlog, will enrich only highest-risk CVEs going forward 2026-04-16 at 19:48 By Zeljka Zorz NIST is overhauling how it manages the National Vulnerability Database (NVD) and switching to a risk-based model that prioritizes “enrichment” of only the most critical CVE-numbered security vulnerabilities. “This change is driven by a surge in […]

NIST admits defeat on NVD backlog, will enrich only highest-risk CVEs going forward Read More »

Anthropic’s new AI model finds and exploits zero-days across every major OS and browser

Anthropic, Artificial Intelligence, automation, Don't miss, Hot stuff, News, vulnerability, vulnerability assessment /

Anthropic’s new AI model finds and exploits zero-days across every major OS and browser 2026-04-08 at 08:12 By Anamarija Pogorelec Automated vulnerability discovery tools have existed for decades, and the gap between finding a bug and building a working exploit has always slowed attackers. That gap is now substantially narrower. Anthropic’s Claude Mythos Preview, a […]

Anthropic’s new AI model finds and exploits zero-days across every major OS and browser Read More »

CISA looks to partners to shore up the future of the CVE Program

CISA, CVE, Don't miss, Government, Hot stuff, MITRE, News, USA, vulnerability assessment /

CISA looks to partners to shore up the future of the CVE Program 2025-09-12 at 15:32 By Zeljka Zorz The US Cybersecurity and Infrastructure Security Agency (CISA) has affirmed its continuing support for the Common Vulnerabilities and Exposures (CVE) program. “If we want to outpace and outmaneuver our adversaries, we must first ensure that defenders […]

CISA looks to partners to shore up the future of the CVE Program Read More »

Review: From Day Zero to Zero Day

books, Don't miss, how-to, News, Review, Reviews, skill development, strategy, tips, vulnerability assessment /

Review: From Day Zero to Zero Day 2025-08-11 at 08:02 By Mirko Zorz From Day Zero to Zero Day is a practical guide for cybersecurity pros who want to move beyond reading about vulnerabilities and start finding them. It gives a methodical look at how real vulnerability research is done. About the author Eugene Lim […]

Review: From Day Zero to Zero Day Read More »

New AI model offers faster, greener way for vulnerability detection

Artificial Intelligence, cybersecurity, Don't miss, Features, Hot stuff, LLMs, News, research, vulnerability assessment /

New AI model offers faster, greener way for vulnerability detection 2025-07-31 at 08:33 By Mirko Zorz A team of researchers has developed a new AI model, called White-Basilisk, that detects software vulnerabilities more efficiently than much larger systems. The model’s release comes at a time when developers and security teams face mounting pressure to secure […]

New AI model offers faster, greener way for vulnerability detection Read More »

Artemis: Open-source modular vulnerability scanner

Don't miss, GitHub, Hot stuff, News, open source, penetration testing, scanner, scanning, software, vulnerability assessment /

Artemis: Open-source modular vulnerability scanner 2025-07-30 at 09:00 By Mirko Zorz Artemis is an open-source modular vulnerability scanner that checks different aspects of a website’s security and translates the results into easy-to-understand messages that can be shared with the organizations being scanned. “The most important feature of the tool is report generation. Besides scanning, it […]

Artemis: Open-source modular vulnerability scanner Read More »

OWASP Nettacker: Open-source scanner for recon and vulnerability assessment

cybersecurity, Don't miss, GitHub, News, open source, OWASP, scanning, software, vulnerability assessment /

OWASP Nettacker: Open-source scanner for recon and vulnerability assessment 2025-06-11 at 09:01 By Mirko Zorz OWASP Nettacker is a free, open-source tool designed for network scanning, information gathering, and basic vulnerability assessment. Built and maintained by the OWASP community, Nettacker helps security pros automate common tasks like port scanning, service detection, and brute-force attacks. It […]

OWASP Nettacker: Open-source scanner for recon and vulnerability assessment Read More »

NIST proposes new metric to gauge exploited vulnerabilities

CISA, CISO, Don't miss, News, NIST, patching, security metrics, vulnerability assessment, vulnerability management /

NIST proposes new metric to gauge exploited vulnerabilities 2025-05-26 at 08:06 By Help Net Security NIST has introduced a new way to estimate which software vulnerabilities have likely been exploited, and it’s calling on the cybersecurity community to help improve and validate the method. The new metric, “Likely Exploited Vulnerabilities” (LEV), aims to close a […]

NIST proposes new metric to gauge exploited vulnerabilities Read More »

Critical vulnerabilities persist in high-risk sectors

Application Security, Black Duck, News, report, software, survey, vulnerability assessment /

Critical vulnerabilities persist in high-risk sectors 2024-11-15 at 06:38 By Help Net Security Finance and insurance sectors found to have the highest number of critical vulnerabilities, according to Black Duck. Finance and insurance industry faces highest vulnerabilities The report, which analyzes data from over 200,000 dynamic application security testing (DAST) scans conducted by Black Duck […]

Critical vulnerabilities persist in high-risk sectors Read More »

Scroll to Top