» Tag
security
518 postsPost-quantum cryptography lands in Python with a single pip install
pyca/cryptography 48 now ships ML-KEM and ML-DSA, bringing NIST-standard post-quantum algorithms to Python. Trail of Bits explains what changes for developers and protocols.
Jadepuffer: The First Fully Autonomous LLM Ransomware
Sysdig researchers documented Jadepuffer, the first fully autonomous LLM ransomware that exploited a Langflow flaw to breach database servers.
A Deterministic Guard Stops LLM Agents From SQL Overfetching
An open-source, LLM-free guard checks agent-generated SQL against user roles before execution, preventing text-to-SQL systems from overfetching sensitive data.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comJanuscape: 16-Year-Old UAF in KVM Shadow MMU Crashes Hosts
CVE-2026-53359 (Januscape) is a 16-year-old UAF in KVM's shadow paging code enabling guest-to-host escape; the public PoC reliably panics the host, disrupting all co-located VMs.
Interlock: Open-Source Tool Catches AI Agents Leaking Secrets
Open-source tool Interlock detects AI agent data exfiltration via byte-level matching across MCP proxies and syscalls, with published known limitations.
After gpg.fail: responsible disclosure and GPG's security reckoning
A 39c3 talk details unpatched GPG vulnerabilities, GnuPG's disputed response, and what AI means for security research and disclosure.
CertiK Uncovers Five DoS Vulnerabilities in Ethereum's Besu Client
CertiK found five DoS vulnerabilities in Ethereum's Besu client, patched in v26.7.1 with advisories following two weeks later.
Python Bytecode: The Security Blind Spot Beyond Source Review
Study of over 1M PyPI packages shows Python .pyc bytecode bypasses source-level security review, exposing CPython to crashes and memory-corruption bugs.
RovoBlast: One Click Turns Atlassian's AI Assistant Into a Data Leak
Varonis details RovoBlast, a one-click prompt injection flaw in Atlassian's Rovo AI assistant that can expose sensitive enterprise data.
Cloudflare OS Bets on Never Trusting Its AI Agents
Cloudflare OS uses a Gatekeeper to simulate unapproved AI agent actions, sandbox every app, and swap credentials for revocable capabilities.