The arrival of AI models like Anthropic's Mythos is compressing exploit timelines, shrinking the window to patch vulnerabilities from weeks to just days or even hours. This acceleration exposes flaws in traditional prioritization methods, where only a handful of findings truly matter - out of 50,000, only a dozen make the cut.
New research reveals that vulnerabilities discovered using AI tools are being exploited at almost the same rate as those found through traditional methods, with a 1.3% exploitation rate for AI-discovered vulnerabilities. This challenges alarmist predictions of an impending AI-driven security crisis.
A newly discovered vulnerability in Gitea, rated 9.8 in severity, allows ordinary repository writers to execute shell commands as the Gitea service account by exploiting a remote code execution bug via a cleverly planted Git hook. This critical flaw, tracked as CVE-2026-60004, puts Gitea users at risk of a devastating attack.
Can AI models uncover weaknesses in centuries-old cryptographic algorithms? A new benchmark, CryptanalysisBench, puts large language models to the test, challenging them to discover real cryptanalytic attacks against historical and contemporary schemes.
An AI system has made a groundbreaking discovery, uncovering significant weaknesses in key encryption algorithms that even the experts didn't know existed. By working together with a human researcher, the AI was able to find a mathematical shortcut that halves the effective strength of HAWK, a digital-signature scheme being considered for post-quantum cryptography.
AI-assisted tools are supercharging vulnerability discovery, uncovering over 1,000 new defects in just six months, yet the rate of exploitation remains surprisingly steady, with only 1.3% of AI-discovered vulnerabilities being exploited in the wild. This finding challenges the notion that AI-discovered vulnerabilities are inherently more attractive to attackers.
Anthropic's Claude AI has made a groundbreaking discovery, cracking a post-quantum cryptography scheme in just three hours and 42 minutes on a 96-core server. The AI, specifically Mythos Preview, uncovered a hidden symmetry that paved the way for a direct key-recovery path.
AI agents are revolutionizing bug hunting, outperforming solo models with a staggering 90% success rate, and uncovering critical security holes in widely used open-source code. This breakthrough has significant implications for cybersecurity, with leading agentic systems like Wiz's Project Atlas and Microsoft's MDASH achieving double-digit gains over single-model competitors.
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlog
The hype around AI-assisted bug discovery may have been overstated, as a recent analysis found that only 1.3% of vulnerabilities identified with AI have been confirmed as exploited in the wild. This surprisingly low rate suggests that AI-assisted discovery may not be the silver bullet for uncovering easily exploitable vulnerabilities.
Researchers have uncovered a long-standing vulnerability in the Linux kernel, known as CVE-2026-53264, which allows a local user to gain root privileges by exploiting a flaw in the packet-scheduling code. This zero-day flaw was identified with the help of AI-assisted research and has since been patched.
A recent security researcher found that over 30% of server management interface passwords can be easily cracked using common wordlists and factory default patterns, exposing a massive 24,650 interfaces to potential threats. This startling vulnerability, CVE-2013-4786, allows hackers to gain unauthorized access to sensitive server management hardware.
Researchers uncovered a disturbing vulnerability in Hugging Face's diffusers library, where three high-severity flaws allowed hackers to secretly execute malicious code through model repositories, bypassing built-in safeguards designed to prevent such threats. This alarming exploit highlights the urgent need for enhanced security measures in AI repositories.
OpenWrt has patched a critical DHCPv6 flaw, known as CVE-2026-53921, that could allow an unauthenticated attacker to execute root code by sending a crafted request to the DHCPv6 server. This severe vulnerability, rated 9.8 out of 10, highlights the importance of updating your OpenWrt setup to prevent potential security breaches.
A decades-old security flaw in Baseboard Management Controller (BMC) interfaces is putting over 24,000 internet-exposed servers at risk of password cracking, thanks to a vulnerability that allows attackers to capture and crack authentication responses. This two-decade-old weakness, tracked as CVE-2013-4786, is a pressing concern for server administrators.
Researchers have uncovered a significant Linux exploit, CVE-2026-53264, that can turn local users into root users, highlighting the importance of human judgement in AI-assisted security work. This flaw, patched in June 2026, shows AI still has limitations, emphasizing the need for human oversight.
The clock is ticking: with legacy technology, organisations know the risks, but lack a mechanism to spark change, leaving nations vulnerable to growing cyber threats. As exploits and AI evolve at breakneck speed, the window for protection is shrinking fast.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Microsoft's new AI model, MAI-Cyber-1-Flash, paired with GPT-5.4, has achieved a remarkable 95.95% vulnerability detection rate at nearly half the cost of its previous system. This game-changing tech, integrated into MDASH, is revolutionizing cybersecurity with faster and more affordable threat detection.
Beware of the Certighost exploit, a sneaky attack that lets hackers hijack Windows domains by manipulating machine account attributes and snagging authentication certificates. This vulnerability, tracked as CVE-2026-54121, was patched in July 2026, but not before security researchers publicly disclosed its technical details.
Microsoft just unveiled a game-changing AI-powered security model that has achieved a remarkable 95.95 percent success rate in identifying vulnerabilities, leaving the competition in the dust. This innovative model, combined with the MDASH harness, is poised to revolutionize bug hunting and cybersecurity.
A newly disclosed exploit for a patched vBulletin flaw shows how an unauthenticated request can be used to execute code on an unpatched forum server, putting vulnerable sites at risk. This security threat was made public on July 27, highlighting the importance of keeping software up to date.
A security flaw in n8n allows authenticated editors to run OS commands, thanks to two overlooked vulnerabilities that let them break free from the platform's protective sandbox. This weakness was uncovered by Security Joes' research team, who found that the flaws could be exploited to execute operating-system commands as the n8n process.
A recent update to Microsoft Defender for Endpoint has caused a major hiccup, crippling Linux protection and potentially leaving some devices vulnerable. The issue affects specific Linux versions, and a simple upgrade or reinstall followed by a reboot could be the culprit behind a disabled Defender service.
NodeBB has patched eight high-severity security flaws that left its forum platform vulnerable to admin access and private chat exposure, affecting all versions prior to 4.14.0. Admins should install the fixes immediately to safeguard their sites.
Oracle's recent release of 1,449 security patches may seem alarming, but experts say it's largely a reflection of the company's massive software ecosystem and its cutting-edge use of AI to supercharge vulnerability detection. This huge number is also a testament to Oracle's proactive approach to staying on top of security threats.