Tag
A cybersecurity blogger argues the current wave of 0-days, broken disclosure embargoes, and overwhelmed defenders is unsustainable, warning that AI cannot solve the patch-management bottleneck for operations teams.
A tweet speculating about the unknown CVEs and zero-day vulnerabilities that national agencies or large AI companies may have discovered and kept undisclosed for months or longer.
PHP 8.x 全系发布紧急安全更新，修复两个远程代码执行漏洞；因协调披露流程泄露导致 PoC 提前扩散，PHP Foundation 与 Wiz 公布了完整披露时间线。
OpenAI's Patch the Planet initiative helped researchers discover critical, internet-scale security vulnerabilities in PHP, coordinating a two-month disclosure process with maintainers to deliver fixes ahead of attackers and marking a new phase where frontier AI finds high-impact security bugs.
OpenAI led a coalition to disclose critical PHP vulnerabilities first discovered by GPT-5.6 Sol, sharing a PHP version checker and a proposed global response framework while committing $1B in subsidized Daybreak access for frontline defenders.
curl项目宣布自2026年10月26日起改变漏洞披露流程，将LOW和MEDIUM级别的漏洞报告公开提交至GitHub，仅HIGH和CRITICAL级别保留在HackerOne私密处理，以应对持续不断的漏洞报告洪流并维持项目生存。
The author warns that AI-generated pull requests and AI-driven security reports create externalities for open-source projects: a frontier AI lab's rigid 90-day disclosure policy, combined with a surge of mostly invalid reports, nearly forced Apache Spark maintainers to choose between shipping with an unpatched known issue or letting the lab disclose publicly without a fix.
A 16-year-old researcher (Faav) describes discovering a signature-validation flaw in Microsoft's internal Titan analytics service that could have exposed an estimated 17.3 trillion stored rows via raw SQL queries, using his AI hackbot Antares to aid the hunt before responsibly reporting it to Microsoft.
The author recounts discovering a major data vulnerability in a Brazilian federal system and discusses the growing cybersecurity risks posed by untested AI environments and reinforcement learning scaling in machine learning.
Security researchers used Anthropic's Claude AI to hack into OpenAI by exploiting a vulnerability in Discourse, gaining access to internal systems and receiving a bug bounty for disclosure.
This talk discusses the disclosure of vulnerabilities in GPG, challenges with responsible disclosure, and the state of security in 2026.
Microsoft issued over 974 security patches, including critical zero-day vulnerabilities, marking its largest single patch batch to date, with AI aiding in faster vulnerability discovery.
An AI model has achieved 84.5% on CyberGym, leading the benchmark, and Z.ai is running a public disclosure ledger for over 2,400 real-world vulnerabilities surfaced by the model.
JFrog and OpenAI collaborated to fix zero-day vulnerabilities discovered by OpenAI's AI models in JFrog's Artifactory, highlighting the need for fast remediation in an era where AI finds and chains exploits at machine speed.
GitHub is restructuring its bug bounty program to prioritize quality over quantity, introducing a permanent VIP program with higher payouts, restructured public bounties with static payouts, and raising signal requirements to reduce low-effort reports.
Using AI audit agents, zkSecurity discovered seven real bugs in Cloudflare's CIRCL cryptography library, including critical precision loss and access-control break. All bugs have been fixed upstream.
Security researcher Eaton discloses vulnerabilities in Johnson & Johnson's Campus Recruiting and Audit Tracking Management System web apps, exposing student data and allowing admin takeover due to flawed authentication using hardcoded API keys.
Microsoft is facing backlash for threatening legal action against a security researcher who publicly posted zero-day exploits, with critics highlighting the company's inconsistent history with vulnerability disclosure.
A security researcher published six unpatched Windows zero-day vulnerabilities, including working exploit code, without Microsoft's knowledge. Microsoft threatened legal action and criminal referrals, drawing widespread criticism from the cybersecurity community over its handling of the situation.
A disgruntled security researcher known as Nightmare Eclipse has escalated a feud with Microsoft by threatening to dump more Windows zero-day exploits, after already releasing six. Microsoft has responded with a blog post and legal threats.