Tag: open-source
-
Week in review: Hidden implant in Ledger wallets linked to $93M theft, 1,500+ npm packages exposed
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Strands Box: Open-source sandbox for AI agents AWS released Strands Box, an … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/18/week-in-review-hidden-implant-in-ledger-wallets-linked-to-93m-theft-1500-npm-packages-exposed/
-
Open-source security rests on understanding risks, scaling fixes
Developers should coordinate security work to make the most of their interconnected ecosystem, IBM said in a new report. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/open-source-software-vulnerabilities-analysis-scaling-ibm/833230/
-
Wasteenergy firm picks Stackable on Ionos for sovereignty
Munich plant builder Martin centralises 10GB of telemetry per line each day on open-source Stackable, hosted by Ionos, to dodge US hyperscaler lock-in and the US Cloud Act First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366652128/Waste-to-energy-firm-picks-Stackable-on-Ionos-for-sovereignty
-
Next.js Ships OutBand Patch for Two Critical RCE Flaws in Caching and SVG Processing
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw.One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images.The fixes are in First seen…
-
Langflow’s Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Tags: ai, cve, exploit, flaw, intelligence, open-source, rce, remote-code-execution, threat, vulnerabilityThreat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM.The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case…
-
Meshery: Open-source cloud-native manager for Kubernetes
Meshery is an open-source tool for designing, deploying and managing Kubernetes infrastructure, built by Layer5 and its community and hosted as a Cloud Native Computing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/14/meshery-open-source-cloud-native-manager-kubernetes/
-
Meshery: Open-source cloud-native manager for Kubernetes
Meshery is an open-source tool for designing, deploying and managing Kubernetes infrastructure, built by Layer5 and its community and hosted as a Cloud Native Computing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/14/meshery-open-source-cloud-native-manager-kubernetes/
-
LiteLLM flaws let low-privileged users hijack AI gateway and steal provider keys
Check Point Research has disclosed two high-risk vulnerabilities in LiteLLM, the open-source gateway that sits between enterprise applications and AI providers such as OpenAI, Anthropic and Google. The flaws could allow a user with minimal privileges to take full control of the gateway, read sensitive files, execute arbitrary code and harvest the API keys an…
-
When LLM Gateways Go Wrong: Findings from LiteLLM
L;DR; Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029, CVE-2026-59823) which have been resolved as of LiteLLM version 1.83.9. The most significant issues stemmed from a missing authorization check on the /config/update endpoint, which allowed any authenticated user (including low-privileged accounts) to modify the…
-
Hackers Exploit Citrix NetScaler Zero-Days to Deploy Modified Platypus Backdoor
Tags: backdoor, citrix, cyber, defense, exploit, framework, hacker, incident response, open-source, threat, vulnerability, zero-dayThreat actors are exploiting two critical zero-day vulnerabilities in Citrix NetScaler to deploy a modified version of the open-source Platypus remote administration framework on compromised Application Delivery Controller (ADC) and Gateway appliances. Binary Defense’s Analysis on Demand and Incident Response team investigated an intrusion involving two Citrix NetScaler devices. One appliance showed evidence of exploitation…
-
Hackers Exploit Citrix NetScaler Zero-Days to Deploy Modified Platypus Backdoor
Tags: backdoor, citrix, cyber, defense, exploit, framework, hacker, incident response, open-source, threat, vulnerability, zero-dayThreat actors are exploiting two critical zero-day vulnerabilities in Citrix NetScaler to deploy a modified version of the open-source Platypus remote administration framework on compromised Application Delivery Controller (ADC) and Gateway appliances. Binary Defense’s Analysis on Demand and Incident Response team investigated an intrusion involving two Citrix NetScaler devices. One appliance showed evidence of exploitation…
-
Researchers Discover 253 Security Vulnerabilities Across 343 AI Agent Tools in MCP Servers
Researchers have identified 253 verified security vulnerabilities affecting 343 AI agent tools across 118 Model Context Protocol (MCP) servers. These vulnerabilities expose weaknesses in how software processes arguments generated by large language models (LLMs). The findings are based on an evaluation of 273 open-source MCP servers containing 3,405 tools, using a new fuzzing framework called…
-
Strands Box: Open-source sandbox for AI agents
AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/12/aws-strands-box-open-source-ai-agent-sandbox/
-
REA: New AI-Powered Reverse Engineering Tool Supports Ghidra, Hopper, and Claude Code
REA, short for Reverse Engineer Anything, connects AI coding agents to reverse-engineering tools, enabling in-depth analysis of native binaries, applications, and runtime behavior. This open-source project supports Ghidra, Hopper, and IDA as native analysis providers. It integrates with Claude Code and other agents through the Model Context Protocol (MCP). New AI-Powered Reverse Engineering Tool Rather…
-
What makes some open source updates so difficult?
Many organizations adopt open source software because they see it as a cheaper alternative to proprietary development. Maintaining it, however, still requires engineering … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/12/google-open-source-maintenance-costs-report/
-
Claude Helps Secure Open Source as Anthropic Offers Free Vulnerability Scanning
Anthropic launches free OSS Scanner, using AI to find open-source vulnerabilities and help maintainers fix bugs before attackers exploit them. Anthropic is launching OSS Scanner, a vulnerability scanner for open-source code that costs nothing for projects to join. It grew directly out of lessons learned running Claude against real-world targets during Project Glasswing. The backdrop…
-
Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects
Anthropic on Thursday unveiled OSS Scanner as an opt-in vulnerability scanner to help secure the open-source ecosystem using artificial intelligence (AI).”It’s an opt-in service informed by our experience using Claude to find vulnerabilities during Project Glasswing,” Anthropic said. “Projects that join will receive thorough, periodic security scans by our strongest models at no cost.” First…
-
Anthropic offers free AI security scans to open-source maintainers
Anthropic’s OSS Scanner is a new, free service that uses the company’s strongest AI models to find security vulnerabilities in open-source software. Maintainers who opt in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/09/anthropic-oss-scanner-ai-security-scans/
-
Anthropic Launches Cyber Mission to Protect Critical Infrastructure and Open-Source Software With Claude AI
Anthropic launched its Cyber Mission, a long-term initiative aimed at helping defenders secure critical infrastructure and open-source software. This initiative utilizes frontier Claude models, offers engineering support, conducts threat research, and provides funding. The Cyber Mission introduces two key components: the Critical Infrastructure Defense Program (CIDP) and the OSS Scanner, a free, opt-in service for…
-
Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software
The critical infrastructure defense program will seek to pair Claude models, Anthropic engineers and threat research with the expertise of cybersecurity companies. First seen on cyberscoop.com Jump to article: cyberscoop.com/anthropic-cybersecurity-program-critical-infrastructure-open-source/
-
Insignary Launches Clarity AIR to Detect Undeclared Open-Source and AI-Written Code
Toronto, Canada, October 8th, 2026, CyberNewswire Insignary Launches Clarity AIR: Closing the Blind Spot Between What Your Developers Declare and What’s Actually in Your Code New snippet-level scanning shows security and compliance leaders which open-source code and which AI-written code never made it into a manifest. Insignary Inc. today announced the general availability of Insignary…
-
Insignary Launches Clarity AIR to Detect Undeclared Open-Source and AI-Written Code
Toronto, Canada, 8th October 2026, CyberNewswire First seen on hackread.com Jump to article: hackread.com/insignary-launches-clarity-air-to-detect-undeclared-open-source-and-ai-written-code/
-
Financially Motivated Hacker Uses Agentic AI to Breach Multiple South Korean Finance Targets
Tags: ai, breach, china, cyber, data-breach, finance, hacker, infrastructure, open-source, penetration-testing, toolA financially motivated campaign that used agentic AI tools to breach South Korean financial organizations and exfiltrate data. Active from late September to early October 2026, the operation combined ARTEX, an open-source penetration testing platform developed in China, with multiple large language models. Researchers recovered exposed operational files that documented the attacker’s infrastructure, prompts, and…
-
ChainDrop and PolinRider Use Blockchain C2 to Steal Cloud and CI/CD Credentials
Tags: access, blockchain, cloud, control, credentials, cyber, endpoint, infrastructure, korea, network, north-korea, open-source, service, threat, wormThreat actors are increasingly using blockchain networks as resilient command-and-control infrastructure to steal cloud credentials from developer endpoints and CI/CD environments. Recent campaigns involving the ChainDrop npm worm and the North Korea-linked PolinRider operation show how poisoned open-source packages can harvest short-lived cloud tokens, service-account credentials, deployment secrets, and source-code access tokens while resolving attacker…
-
Java library vulnerabilities: IBM and Red Hat fix 400+ previously unknown flaws
IBM and Red Hat have found and fixed more than 400 previously unknown vulnerabilities in widely used Java libraries through Lightwell, their program for patching open source … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/08/lightwell-java-library-vulnerabilities/
-
South Korea Suspects AI Tool Helped Steal Bank Customer Data
Attack Servers Show Signs Open-Source Penetration Testing Tool Artex Employed. Police in South Korea probing data breaches at multiple banks have found signs on attack servers that the threat actor used a free, open-source and semi-automated penetration testing tool called Artex AI to help steal data pertaining to more than 60,000 individuals. First seen on…
-
Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely
A critical vulnerability in LMCache, open-source software that speeds up large language model (LLM) servers such as vLLM, lets an attacker run code on the cache server without logging in, and no fixed version is available.The flaw is in LMCache’s multiprocess mode, where the cache runs as a standalone server that LLM workers reach over…
-
Fehlersuche per KI: IBM und Red Hat finden mehr als 400 Bugs in Java Code
Das gemeinsame Projekt Lightwell nutzt KI-Agenten zum Aufspüren von Schwachstellen in Open-Source-Software – und zur Entwicklung der benötigten Patches. First seen on golem.de Jump to article: www.golem.de/news/fehlersuche-per-ki-ibm-und-red-hat-finden-mehr-als-400-bugs-in-java-code-2610-213801.html
-
AI Agent Gateway: Open-source tool keeps credentials out of agent configs
Tuskira’s AI Agent Gateway is an open-source solution that sits between AI agents and everything they call: the MCP tool servers that connect them to services like … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/07/open-source-ai-agent-gateway/
-
AI Agent Gateway: Open-source tool keeps credentials out of agent configs
Tuskira’s AI Agent Gateway is an open-source solution that sits between AI agents and everything they call: the MCP tool servers that connect them to services like … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/07/open-source-ai-agent-gateway/