Fake CVEs Need Real Friction
A fabricated batch of SQLite vulnerability reports shows why security automation needs verification gates, not just faster ingestion.
// Topic
Security
Dependabot Adds A Three-Day Brake
GitHub's new Dependabot cooldown waits three days before version-update pull requests, giving fresh package releases time to collect scrutiny.
PyPI Closes The Old Release Door
PyPI now rejects new files on releases older than 14 days, narrowing a supply-chain path where a compromised publisher could poison a long-stable version.
Dusseldorf Gives OAST A Private Callback Plane
Microsoft's open-source Dusseldorf project turns out-of-band application security testing into private infrastructure for capturing DNS, HTTP, and HTTPS callbacks.
Linux Cleans Up The Syscall Doorway
A Thomas Gleixner patch series slated for Linux 7.3 tightens the kernel's syscall entry path, making stack randomization more consistent and the x86 syscall logic easier to follow.
Linux Hardens A Realtek Wi-Fi Driver Against Bad Access Points
Linux staging fixes are tightening the Realtek RTL8723BS Wi-Fi driver against malformed over-the-air data from malicious access points, closing several out-of-bounds paths in old driver code.
LLVM Gives Native Code A Smaller Sandbox
LLVM has merged x86 and x86_64 support for Lightweight Fault Isolation, giving native C, C++, and assembly code a compiler-level path toward in-process sandboxing.
OpenSSH 10.4 Hardens The Quiet Path
OpenSSH 10.4 is not a flashy remote-access release. It is the kind operators should notice anyway: stricter sandbox failure behavior, tighter rekey handling, SFTP and SCP security fixes, and a cautious post-quantum signature experiment.
Security Profiles Need an API Contract
Security Profiles Operator v1 is a reminder that container hardening does not become operational until profiles can be recorded, reviewed, shipped, and bound like normal Kubernetes objects.
Homebrew 6 Locks the Tap Before It Pours
Homebrew 6.0 turns third-party taps into explicit trust decisions, adds Linux sandboxing, and quietly makes the developer laptop feel less like an unattended loading dock.
Cloudflare Puts Threat Feeds Inside the WAF
Cloudflare's new cf.intel WAF fields let teams turn Cloudforce One threat indicators into live rules, so bad traffic can be blocked by context instead of yesterday's copied IP list.
OpenAI Gives ChatGPT a Lockdown Switch
OpenAI is turning ChatGPT security into a real control surface with Lockdown Mode, Active sessions, passkeys, and stricter recovery for accounts that carry sensitive work.
Signing Keys Became Infrastructure
GitHub's Enterprise Server signing-key rotation is a reminder that update verification keys are not paperwork. They are part of the production control plane.
VPN Cookies Became Keys
Palo Alto's exploited GlobalProtect bug is a reminder that convenience cookies on edge VPNs are not just session helpers. In the wrong configuration, they become perimeter keys.
MCP Tools Need Risk Labels
MCP tool annotations are becoming the vocabulary agents need for safer tool use, but labels only help when clients pair them with real policy, identity, and runtime controls.
Open Source Gets A Clearinghouse
IBM and Red Hat's Project Lightwell points to a new phase of open source security: AI can find more bugs, but enterprises now need a coordinated system for verified fixes.
Cargo's Cache Was a Trust Boundary
Rust's Cargo fix for CVE-2026-5223 is a reminder that package managers do not just download code. They define which parts of the build machine other people are allowed to touch.
Deleted Keys Still Work
Aikido measured Google API keys authenticating for up to 23 minutes after deletion. That turns credential revocation from a button into a timed incident-response window.
The npm Trust Signal Broke
Mini Shai-Hulud turned trusted publishing, CI cache reuse, and developer credentials into one continuous attack path. The fix is not less automation. It is stricter boundaries around the automation we already rely on.
Microsoft's RAMPART and Clarity Move Agent Safety Into CI
Microsoft's new open-source RAMPART and Clarity tools point agent safety toward the same place reliable software already lives: repeatable tests, design review, and CI gates.
AI Bug Hunters Are Becoming Security Infrastructure
Microsoft and Mozilla have both shown that AI vulnerability discovery works best as a pipeline, not a magic model. The next security advantage belongs to teams that can turn model output into proven fixes.
A Linux Kernel Bug Is Letting Local Users Read Files They Should Never See
ssh-keysign-pwn is a Linux kernel flaw that lets unprivileged local users read root-owned files on affected systems, including SSH host keys and shadow password data.
End of list