Tag
Google paused its Open Source Software Vulnerability Rewards Program until 2027, citing a 'significant rise' in automated AI submissions that were largely invalid or hallucinated, overwhelming engineers and open source maintainers.
Google Threat Intelligence Group revealed that an undercover researcher infiltrated the notorious hacking group TeamPCP, allowing Google to monitor their supply-chain attacks, warn targets, and assist law enforcement in arrests.
An ongoing campaign is targeting prominent Rust developers through social engineering to compromise devices and publish malware, with recent supply chain attacks on crates like array ref highlighted. Recommended defense includes dependency cooldowns to mitigate risks.
The article proposes using AI to proactively find and fix software vulnerabilities in open-source code for critical infrastructure, addressing cybersecurity market failures and scaling with AI advancements.
Anthropic is expanding access to Claude Mythos 5 for cybersecurity defenders through tool integrations, security scans, a $35M fund for open-source projects, and an enhanced verification program.
The article argues that GNU IFUNC and design decisions linking OpenSSH to SystemD were the primary enablers of the CVE-2024-3094 xz-utils backdoor, rather than the malicious code itself.
Manus demonstrates their MYTHOS SI security technology by claiming to discover and remediate parsing/authentication vulnerabilities in Anthropic's Claude Code, FFmpeg, and CWebStudio, positioning their recursive substrate healing approach as superior to traditional detection-based tools.
Anthropic's Project Glasswing, using Claude Mythos Preview, has found over ten thousand high- or critical-severity vulnerabilities in critical software, with partners like Cloudflare reporting a tenfold increase in bug-finding rate.