Tag: open source software
36 articles
Vulnerabilities in LiteLLM Gateway Expose AI Systems to Takeover
With two high-risk vulnerabilities discovered in LiteLLM, a popular open-source gateway tool, hackers can easily hijack AI systems, allowing them to wreak havoc and cause serious damage. Anyone with an account on a vulnerable deployment can take over the gateway and exploit it for malicious purposes.
Anthropic Launches Cybersecurity Program to Fortify Critical Infrastructure
Anthropic is stepping up to support defenders of critical infrastructure and open-source software, who are rich in experience but often low on resources, by launching a long-term cybersecurity program to identify and fix vulnerabilities. By combining its Claude models, engineering expertise, and threat research with partner cybersecurity firms, Anthropic aims to help safeguard critical infrastructure from exploitation.
Google Halts Open-Source Bug Bounty Payouts Amid Automated Report Surge
Google is hitting the pause button on its open-source bug bounty program due to a surge in automated submissions, most of which are invalid. The temporary suspension will be revisited in 2027 with a revamped program.
Google Suspends Open-Source Bug Bounty Program Amid AI-Generated Spam Surge
Google is hitting the pause button on its Open Source Software Vulnerability Rewards Program, temporarily stopping new product vulnerability submissions due to a surge in AI-generated spam. This change doesn't affect existing reports or supply chain submissions.
Zero-days in Zammad ticketing system enable AI-driven network breach
In a shocking breach, two zero-day vulnerabilities in the Zammad ticketing system were exploited in tandem to hijack sessions, run code remotely, and escalate privileges to root in mere seconds. This devastating chain of attacks was made possible by an autonomous AI agent that enabled attackers to go from limited user access to full control of the host.
NVIDIA Bolsters AI Security with Open-Source Agent Safety Platform
NVIDIA just unveiled an open-source platform to ensure AI agents operate safely and transparently, earning trust through robust control and governance. The Open Agent Safety Platform has already garnered support from over 100 AI organizations.
BIND 9 Update Fixes 14 Flaws, Including Unauthenticated Crashes
The Internet Systems Consortium has rolled out a crucial BIND 9 update that patches 14 security flaws, including unauthenticated crashes, to keep your DNS server safe and secure. Fortunately, no active exploits have been reported so far, but it's still essential to update to the latest releases: BIND 9.20.29, BIND 9.21.26, or BIND 9.20.29-S1 to fix the vulnerabilities.
Validation Gap Widens as AI Spurs Vulnerability Surge
The alarming gap between vulnerability discovery and exploitation is growing: a staggering 35,853 CVEs were published in the first half of 2026, with a whopping 49% surge from the previous year. Meanwhile, only a tiny fraction - 495 - were actually exploited in the wild.
GeoNetwork Flaw Exposes Government Geoportal Backends to Unauthenticated Code Execution
A shocking security flaw in GeoNetwork has been discovered, leaving government and agency geoportals vulnerable to unauthenticated code execution - and it's already been exploited in 121 internet-exposed deployments across 39 countries. The vulnerability allows attackers to upload malicious files, giving them free rein to wreak havoc on sensitive systems.
Australian Police Disrupt Notorious Cybercrime Group TeamPCP
In a major cybercrime crackdown, Australian authorities have arrested two alleged members of the notorious TeamPCP group, accused of infecting over a thousand organizations worldwide with malicious code. The suspects, aged 21 and 23, face serious charges, including unauthorized data modification and dealing in criminal proceeds.
Australian Police Disrupt TeamPCP Cybercrime Syndicate
Meet Ellis, a self-proclaimed cybercrime rockstar who thought "blackhatting is fun" - but his thrill-seeking days are over, thanks to the Australian Federal Police's crackdown on the notorious TeamPCP syndicate. Two young men from Western Australia have been arrested in connection with a massive software supply-chain scam that targeted thousands of global businesses.
CISA Warns of Hackers Exploiting MLflow Vulnerability
Hackers are actively exploiting a critical vulnerability in MLflow, a popular open-source AI engineering platform, that could compromise your AI applications. Federal agencies have been ordered to patch exposed instances within two weeks to avoid potential attacks.
Open Source Software Faces Reckoning
Open source software had a carefree adolescence, running wild and free for two decades, but its idyllic era is now coming to an abrupt end, forcing it to confront a harsh new reality. It's time for open source to grow up and face the challenges of a rapidly changing world.
Gitea Flaw Exposes Server Files to Unauthenticated Attackers
A critical vulnerability, CVE-2026-59774, left self-hosted Gitea servers open to attack, allowing unauthenticated hackers to access sensitive files. Immediate action is required for self-hosted administrators to upgrade to version 1.27.1 and prevent exploitation.
AI-Powered Vulnerability Discovery Surges, Threatens Patch Window
In a staggering two-month sprint, Palo Alto Networks' NOVA uncovered 14,090 confirmed vulnerabilities in just 3,915 open-source software projects - a remarkable demonstration of AI-powered vulnerability discovery's rapid impact. This autonomous pipeline is revolutionizing the way we identify and tackle software vulnerabilities.
CISA Issues Guidance on Open-Source Software Security Risks
The Cybersecurity and Infrastructure Security Agency is stepping up to help manage open-source software security risks with a new guidebook titled "Open Source Software: Security Principles and Practices". This move aims to enhance the nation's cybersecurity by providing federal agencies with essential security recommendations.
Amazon Exposes North Korean Hacking Campaign Targeting Open-Source Software
A North Korea-linked hacking group has been exploiting widely-used open-source software, infecting millions of users through compromised packages like axios, which alone receives over 100 million downloads weekly. This campaign, linked to a single financially motivated actor, has been targeting major JavaScript packages since March 2025.
Ruflo Flaw Exposes AI Systems to Unauthenticated Code Execution
A critical vulnerability in Ruflo, known as RufRoot, allows hackers to execute code remotely without authentication, putting AI systems at risk. This severe flaw, rated 10.0 on the CVSS scale, affects all Ruflo versions before 3.16.3.
Governments Struggle to Secure Open-Source Software
The alarming reality is that years of underinvestment in open-source software security are catching up with us, with a new supply chain compromise emerging almost every week. A recent scan by Project Glasswing found over 6,000 high-risk vulnerabilities in popular open-source projects, but only a tiny fraction have been patched.
Chainguard Launches Athena to Fortify Open Source Against AI Threats
Meet Athena, a groundbreaking coalition and platform that helps safeguard open-source software from AI-driven threats by streamlining vulnerability detection, private remediation, and coordinated disclosure. By joining forces, Athena members can proactively protect the entire open-source ecosystem from emerging risks.
Gogs Fixes Zero-Day Flaw Enabling Remote Code Execution
A critical vulnerability in Gogs allows attackers to execute remote code, putting Internet-facing instances at risk of full compromise - and it's easily exploitable by anyone who can create an account. This flaw enables attackers to wreak havoc without needing admin privileges, making swift action a must.
Open Source Faces Hard Fork Amid AI-Fueled Security Crisis
The open source community is facing a daunting security crisis fueled by AI, giving rise to a new category of threat dubbed "Mythos" - a complex chain of low-level issues that can be combined to create devastating attacks. This emerging threat is not just a single bug or false positive, but a game-changing phenomenon that demands immediate attention.
Security Researcher Exploits Flaw in Pretalx Conference Tool
A security researcher recently uncovered a vulnerability in pretalx, a popular conference tool, that could let hackers inject malicious code into an organizer's interface, putting sensitive data at risk. This flaw, known as a stored cross-site scripting vulnerability, could be triggered through simple search queries.
Grafana Breach Exposes Codebase, Sparks Extortion Attempt
Grafana recently experienced a security breach, where an unauthorized party gained access to its GitHub environment, downloading its codebase, but fortunately, no customer data or personal info was compromised. The company swiftly responded, taking measures to prevent further unauthorized access and thwarting an attempted extortion by the attacker.