Tag: open-source
-
AI Agent Gateway: Open-source tool keeps credentials out of agent configs
Tuskira’s AI Agent Gateway is an open-source solution that sits between AI agents and everything they call: the MCP tool servers that connect them to services like … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/07/open-source-ai-agent-gateway/
-
AI slop overwhelms Google’s OSS bug bounty programme
Google has closed its open source vulnerability reporting programme to new submissions while it recalibrates in the face of a surge in automated junk reports. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366651792/AI-slop-overwhelms-Googles-OSS-bug-bounty-programme
-
AI slop overwhelms Google’s OSS bug bounty programme
Google has closed its open source vulnerability reporting programme to new submissions while it recalibrates in the face of a surge in automated junk reports. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366651792/AI-slop-overwhelms-Googles-OSS-bug-bounty-programme
-
Google Pauses Open-Source Bug Bounty Program Amid AI Slop
Tech Giant Cites ‘Significant Rise in Automated Submissions’ Lacking Validity. Google has indefinitely paused a bug bounty program designed to reward researchers who find flaws in the open-source software it maintains, citing a significant rise in automated submissions, the vast majority of which are not valid. Other software maintainers report similar struggles. First seen on…
-
LibreOffice says ‘no AI’ is now a software feature
The maker of the open source document editor says it has no plans to add AI to its software’s default configuration, citing user privacy. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/06/libreoffice-says-no-ai-is-now-a-software-feature/
-
Red Hat’s Lightwell Project Remediates 400 Open-Source Vulnerabilities
The IBM subsidiary has also announced its Lightwell Clearinghouse is now available to all customers First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/red-hat-lightwell-remediates-400/
-
Bug-Bounty-Programm: Zu viele falsche KI-Meldungen für Google
Viele automatisierte Fehlermeldungen sind unbrauchbar. Google nimmt deshalb vorerst keine neuen Open-Source-Berichte mehr an. First seen on golem.de Jump to article: www.golem.de/news/ungueltige-ki-einreichungen-google-stoppt-bug-bounty-programm-fuer-open-source-2610-213721.html
-
Bug-Bounty-Programm: Zu viele falsche KI-Meldungen für Google
Viele automatisierte Fehlermeldungen sind unbrauchbar. Google nimmt deshalb vorerst keine neuen Open-Source-Berichte mehr an. First seen on golem.de Jump to article: www.golem.de/news/ungueltige-ki-einreichungen-google-stoppt-bug-bounty-programm-fuer-open-source-2610-213721.html
-
Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports
Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software.The change, in effect since October 1, means researchers can no longer submit security flaws in the code of projects such as Go, Angular, and Protocol Buffers there for a reward. Reports about supply chain compromises are still accepted, and…
-
Ungültige KI-Einreichungen: Google stoppt Bug-Bounty-Programm für Open Source
Die überwiegende Mehrheit der automatisiert eingereichten Fehlermeldungen ist ungültig. Google überarbeitet nun seine Regeln für KI-basierte Einreichungen. First seen on golem.de Jump to article: www.golem.de/news/ungueltige-ki-einreichungen-google-stoppt-bug-bounty-programm-fuer-open-source-2610-213721.html
-
New RemoveMacAI Tool Removes Apple Intelligence Models and Reclaims Mac Storage
A new open-source command-line utility called RemoveMacAI lets Apple silicon Mac users running macOS 27 disable Apple Intelligence, remove downloaded on-device AI models, and prevent the operating system from automatically downloading them again. Developed by Om Lahore and released under the MIT license, RemoveMacAI addresses storage and manageability concerns for users who have disabled Apple…
-
New RemoveMacAI Tool Removes Apple Intelligence Models and Reclaims Mac Storage
A new open-source command-line utility called RemoveMacAI lets Apple silicon Mac users running macOS 27 disable Apple Intelligence, remove downloaded on-device AI models, and prevent the operating system from automatically downloading them again. Developed by Om Lahore and released under the MIT license, RemoveMacAI addresses storage and manageability concerns for users who have disabled Apple…
-
New RemoveMacAI Tool Removes Apple Intelligence Models and Reclaims Mac Storage
A new open-source command-line utility called RemoveMacAI lets Apple silicon Mac users running macOS 27 disable Apple Intelligence, remove downloaded on-device AI models, and prevent the operating system from automatically downloading them again. Developed by Om Lahore and released under the MIT license, RemoveMacAI addresses storage and manageability concerns for users who have disabled Apple…
-
Google Tightens Open-Source Bug Bounty Rules After Surge in AI-Generated Vulnerability Reports
Google has stopped accepting new >>product vulnerability<< reports through its Open Source Software Vulnerability Reward Program (OSS VRP) due to a significant increase in automated submissions that are predominantly invalid. This restriction took effect on October 1, 2026, and Google plans to provide an update regarding this part of the program in the first quarter…
-
AWS Fixes AI Agent Flaws Enabling Authentication Bypass and Credential Theft
Tags: access, ai, authentication, credentials, cyber, flaw, open-source, theft, update, vulnerabilityAWS released security updates for three vulnerabilities in its open-source Loom platform, used for AI agent orchestration. These vulnerabilities could allow unauthenticated administrative takeover, disclosure of OAuth2 credentials, and access to internal services. The company strongly urges users to upgrade all Loom deployments and forks to version 1.7.0. AWS announced these issues in Security Bulletin…
-
Google Suspends Open-Source Bug Bounty Due to AI Vulnerability Reports
Google has paused its Open Source Vulnerability Rewards Program due to a flood of AI submissions First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/google-suspends-opensource-bug/
-
Google Suspends Open Source Bug Bounty Over AI-Generated Reports
Google has suspended its Open Source Software Vulnerability Rewards Program (OSS VRP), a vulnerability search initiative that paid researchers for finding flaws in the company’s open-source software. The pause took effect on October 1, 2026. Google blamed a “significant rise” in automated and AI-generated reports, most of which turned out to be invalid. First seen…
-
AI slop submissions force Google to freeze its open-source bug bounty
Google has stopped accepting new product vulnerability reports through its Open Source Software Vulnerability Reward Program (OSS VRP), after a wave of invalid, AI-generated … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/05/google-ai-generated-vulnerability-reports-pause/
-
Google halts open-source bug bounty program amid AI spam surge
Google has now suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flooded by AI-generated reports. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/google/google-halts-open-source-bug-bounty-program-amid-ai-spam-surge/
-
Keyorix: Open-source secrets management for teams that can’t use SaaS
Keyorix is an open-source secrets manager that runs entirely on a company’s own servers. A secrets manager is the locked store where an application fetches the database … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/05/keyorix-open-source-on-premise-secrets-management/
-
Google froze its open source bug bounty program due to a ‘significant rise’ in AI submissions
AI slop seems to be overwhelming bug bounty programs. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/04/google-froze-its-open-source-bug-bounty-program-due-to-a-significant-rise-in-ai-submissions/
-
AWS AI Agent Vulnerabilities Let Attackers Bypass Authentication and Steal Credentials
Tags: access, ai, authentication, cloud, credentials, cyber, flaw, open-source, service, vulnerabilityAWS has released security fixes for four vulnerabilities affecting its open-source Loom AI agent orchestration platform and Amazon SageMaker Unified Studio. The flaws could allow attackers to bypass authentication, steal OAuth2 tokens and temporary cloud credentials, access internal services, and execute arbitrary code in another user’s SageMaker environment. AWS disclosed the issues in security bulletins…
-
Vom Garagenprojekt zum Milliardengeschäft der Aufstieg von Open Source
Linux begann 1991 als unfertiger Kernel für wenige Rechner. Heute trägt Open Source Rechenzentren, Clouds, Behördenportale und KI-Plattformen. Der offene Code allein erklärt diesen Erfolg jedoch nicht. Entscheidend waren professionelle Betriebsmodelle, verlässlicher Support und die Erkenntnis, dass technologische Wahlfreiheit einen messbaren strategischen Wert besitzt. Für CIOs lautet die Kernfrage deshalb nicht mehr, ob Open Source……
-
Zammad Vulnerabilities Let Attackers Execute Code and Escalate Privileges to Root
Two critical vulnerabilities in the open-source Zammad helpdesk and ticketing platform can be exploited together, enabling attackers to achieve remote code execution and gain root-level control of affected servers. The Dutch Institute for Vulnerability Disclosure (DIVD) and Merlon Security discovered these vulnerabilities, tracked as CVE-2026-102489 and CVE-2026-102490, during an investigation into a breach of DIVD’s…
-
Zammad Vulnerabilities Let Attackers Execute Code and Escalate Privileges to Root
Two critical vulnerabilities in the open-source Zammad helpdesk and ticketing platform can be exploited together, enabling attackers to achieve remote code execution and gain root-level control of affected servers. The Dutch Institute for Vulnerability Disclosure (DIVD) and Merlon Security discovered these vulnerabilities, tracked as CVE-2026-102489 and CVE-2026-102490, during an investigation into a breach of DIVD’s…
-
Hackers Are Turning Trusted Software Updates Into Credential-Stealing Malware
Tags: attack, credentials, cyber, flaw, github, hacker, malicious, malware, open-source, software, supply-chain, updateA growing wave of supply-chain attacks is proving the opposite: attackers are compromising legitimate open-source packages and using trusted update channels to deploy credential-stealing malware directly into developer and enterprise environments. Malicious Nx releases, published after attackers stole an npm publishing token through a GitHub Actions workflow flaw, ran post-install scripts that searched systems for…
-
AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit
An agentic AI-powered attack that hit the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21 exploited two zero-day vulnerabilities in Zammad, an open-source … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/01/divd-agentic-ai-attack-breach/
-
DIVD says Zammad zero-days enabled AI-driven network breach
The Dutch Institute for Vulnerability Disclosure (DIVD) says that the breach of its network was possible by exploiting a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/divd-says-zammad-zero-days-enabled-ai-driven-network-breach/
-
Legit Security launches agentic remediation for open-source dependency vulnerabilities
Tel Aviv, Israel, 30th September 2026, CyberNewswire First seen on hackread.com Jump to article: hackread.com/legit-security-launches-agentic-remediation-for-open-source-dependency-vulnerabilities/
-
OperTraitor Finds Kubernetes Operators With Cluster-Wide Secret Access and Admin Paths
OperTraitor, an open-source, LLM-powered engine that identifies Kubernetes operators whose RBAC (Role-Based Access Control) privileges exceed their documented operational requirements. Research indicates that over 5% of assessed operators requested excessive permissions, including cluster-wide access to secrets and potential pathways to cluster-admin-level control. Kubernetes operators automate application deployment, configuration, and lifecycle management through Custom Resource Definitions…