Tag: open-source
-
OWASP Noir: Open-source static analysis tool
OWASP Noir is an open-source static analysis tool that reads an application’s source code and lists the endpoints it exposes: paths, HTTP methods, parameters, headers, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/30/owasp-noir-open-source-static-analysis-tool/
-
OpenAI Dots Pushes Always-on Agents Into the Enterprise
New Personal Agent Adds Guardrails But Leaves Security Teams With Limited Governance. OpenAI announced Dots, a new always-on personal agent powered by GPT-6 Astra that the company said would offload tasks and screen time from users. Dots competes against Meta’s Muse personal agent, and both represent the evolution of OpenClaw, the open-source agent that lets…
-
101 Malicious npm Packages Add Developers’ WhatsApp Accounts to Groups Without Consent
Cybersecurity researchers have identified a cluster of 101 npm packages that are used to trap developers into a WhatsApp group subscriber campaign dubbed PhantomSub.”The malicious packages abuse the ‘Baileys’ WhatsApp open source project to add the victims to groups without their consent,” OX Security researchers Nir Zadok, Moshe Siman Tov Bustan, and Vitalii Chepurko said…
-
GitHub AI Agent Uncovers 24 Android App Vulnerabilities
GitHub Security Lab has disclosed 24 vulnerabilities in Android applications discovered through its open-source AI security agent and specialized audit taskflows. The findings highlight issues that could enable covert location tracking in the OsmAnd navigation app and account takeover attacks against Wikipedia users on Android. Kevin Stubbings, a researcher at GitHub Security Lab, developed targeted…
-
Cloudflare’s EmDash 1.0 makes sandboxed plugins ask for access first
Cloudflare released EmDash 1.0, a free, open source content management system that locks each sandboxed plugin in its own isolated runtime. A plugin starts with access to its … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/29/cloudflare-emdash-plugin-security/
-
Cloudflare’s EmDash 1.0 makes sandboxed plugins ask for access first
Cloudflare released EmDash 1.0, a free, open source content management system that locks each sandboxed plugin in its own isolated runtime. A plugin starts with access to its … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/29/cloudflare-emdash-plugin-security/
-
GitHub’s AI agent found 24 Android app vulnerabilities
GitHub Security Lab researcher Kevin Stubbings built custom AI-driven audit workflows, called taskflows, on top of the lab’s open source Taskflow Agent, and used them to … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/29/github-ai-android-app-vulnerabilities/
-
Hottest cybersecurity open-source tools of the month: September 2026
Presented here is a curated selection of noteworthy open-source cybersecurity solutions that have drawn recognition for their ability to enhance security postures across … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/29/hottest-cybersecurity-open-source-tools-of-the-month-september-2026/
-
Hottest cybersecurity open-source tools of the month: September 2026
Presented here is a curated selection of noteworthy open-source cybersecurity solutions that have drawn recognition for their ability to enhance security postures across … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/29/hottest-cybersecurity-open-source-tools-of-the-month-september-2026/
-
Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts
The botnet uses the open source Hermes Agent AI framework to execute commands via Telegram and steal AI API keys from exposed Docker hosts. First seen on darkreading.com Jump to article: www.darkreading.com/identity-access-management-security/carbonato-botnet-ai-agent-hacked-docker-hosts
-
As AI world debates security, NVIDIA releases open source tools for agents
One expert told CyberScoop that the announcement reflects industry recognition that after years of training models to behave safely or ethically, more outside controls are needed. First seen on cyberscoop.com Jump to article: cyberscoop.com/nvidia-open-agent-safety-platform/
-
NVIDIA Launches In-Silicon Security Platform to Monitor and Control Autonomous AI Agents
NVIDIA has launched its Open Agent Safety Platform, a security architecture designed for out-of-band monitoring, runtime policy enforcement, and hardware-backed control for autonomous AI agents. This platform combines the open-source NVIDIA OpenShell runtime with NVIDIA Sentry protections on BlueField-4 data processing units (DPUs), aiming to prevent agents from exceeding their authorized access or operating limits.…
-
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Cybersecurity researchers have disclosed details of a new botnet malware called Carbonato that’s targeting exposed Docker daemons to deploy an open-source artificial intelligence (AI) agent framework called Hermes Agent.”The implant installs the framework unchanged, then overwrites its SOUL.md persona file,” ThreatDown said. “The 39-line prompt directs it to execute tasks received through First seen on…
-
Künstliche Intelligenz: Nvidia will ausbrechende KI-Systeme mit neuen Tools eindämmen
Mit seinen neuen Open-Source-Tools hätte OpenAIs Angriff auf Hugging Face verhindert werden können, sagt Nvidia. First seen on golem.de Jump to article: www.golem.de/news/kuenstliche-intelligenz-nvidia-will-ausbrechende-ki-systeme-mit-neuen-tools-eindaemmen-2609-213488.html
-
12 Best Cloud Compliance Tools Compared (2026): Features Pricing
For most teams facing an audit, Vanta is the best overall compliance automation platform, with Drata the closest rival choose between them on integrations and framework-crosswalk economics. For technical posture evidence, free open-source Prowler plus a CNAPP compliance view (Wiz, Prisma, Orca) covers the engineering side to prevent cloud misconfigurations that lead to data breaches.…
-
Hackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker Servers
Tags: access, ai, authentication, botnet, control, cyber, data-breach, docker, framework, hacker, open-source, tool, wormA Docker-focused botnet that repurposes the legitimate, open-source Hermes Agent framework as an interactive post-compromise control layer. The campaign, tracked as CARBONATO, targets Docker daemons exposed without authentication on TCP port 2375, then combines worm-like propagation, stealthy persistence, reverse SSH access and Telegram-driven AI-agent operations. The investigation began in August 2026 after researchers identified a…
-
12 Best AWS Security Tools Compared (2026): Features Pricing
If you’re securing AWS in 2026, Wiz is the best overall third-party platform for most mid-size and enterprise estates, thanks to agentless attack-path correlation that turns thousands of findings into a short, fixable list. Budget-conscious teams should start with AWS-native security tools plus open-source Prowler a genuinely credible free layer. This guide compares 12 of…
-
Authorizer: Open-source authentication and authorization for your apps
Authorizer is an open-source server for sign-in and access control in web and mobile apps. Teams run it on their own infrastructure and keep user accounts in a database they … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/28/authorizer-open-source-authentication-server/
-
Der Aufstieg von Open Source – 35 Jahre Linux: Vom Garagenprojekt zum Milliardengeschäft
First seen on security-insider.de Jump to article: www.security-insider.de/35-jahre-linux-vom-garagenprojekt-zum-milliardengeschaeft-a-566fb3b1cc3b99bd3aa13e47c1e18233/
-
Der Aufstieg von Open Source – 35 Jahre Linux: Vom Garagenprojekt zum Milliardengeschäft
First seen on security-insider.de Jump to article: www.security-insider.de/35-jahre-linux-vom-garagenprojekt-zum-milliardengeschaeft-a-566fb3b1cc3b99bd3aa13e47c1e18233/
-
Dubai Unveils Open-Source Deepfake Detection AI
Cybersecurity Regulator Says Saraab AI Model Can Spot Deepfakes With 91% Accuracy. The Dubai Electronic Security Center, the Middle Eastern emirate’s cybersecurity regulator, has built an AI model called Saraab that detects deepfake videos, and plans to open source it by the end of the year so it can be improved by researchers, AI companies…
-
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials
A critical vulnerability in Bifrost, an open-source AI gateway that routes requests to more than 20 LLM providers, allows an unauthenticated attacker to run arbitrary commands on the gateway server with a single HTTP request.The flaw, tracked as CVE-2026-90898 (CVSS score: 9.8), affects all versions of the Bifrost HTTP transport before 2.1.0 when management authentication…
-
Researchers uncover malware that uses AI to choose its next move
To help security practitioners catch malware that leans on AI, researchers from Cisco Talos shared an open-source framework that they hope will be used to classify and analyze … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/22/cairn-open-source-framework-ai-malware-closedquorum/
-
Gopass: Open-source command-line password manager for teams
Gopass is a free, open-source password manager that stores credentials in an encrypted store and runs from the command line. Its maintainers built it as a drop-in replacement … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/21/gopass-open-source-password-manager/
-
Gopass: Open-source command-line password manager for teams
Gopass is a free, open-source password manager that stores credentials in an encrypted store and runs from the command line. Its maintainers built it as a drop-in replacement … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/21/gopass-open-source-password-manager/
-
Gopass: Open-source command-line password manager for teams
Gopass is a free, open-source password manager that stores credentials in an encrypted store and runs from the command line. Its maintainers built it as a drop-in replacement … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/21/gopass-open-source-password-manager/
-
Software Supply Chain Security – Wenn Open-Source-Pakete zur Hintertür werden
First seen on security-insider.de Jump to article: www.security-insider.de/operation-navy-ghost-backdoor-supply-chain-a-a7aef14bca7ea71dbb268aaf312f2b5f/
-
BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS
The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH).A sender with no credentials can crash the server process, named, with a single request that…
-
AI is adding to the review load on open-source projects, many of them thinly funded
AI coding tools are making open source software harder to maintain and secure, according to six authors writing for the Association for Computing Machinery’s Technology … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/17/ai-and-open-source-projects/
-
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation.The vulnerability in question is CVE-2026-89026 (CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3), which can allow an unauthenticated remote attacker to execute arbitrary operating system (OS) commands by taking advantage of a hard-coded First…