Future AGI: Open-source platform for shipping self-improving AI agents
Future AGI is an open-source platform for tracing, evaluating, simulating, and guardrailing LLM agents, licensed Apache 2.0 and self-hostable. Self-hosted instances register …
AI developers targeted via trojanized GitHub repositories
Cybercriminals are cloning popular GitHub repositories for AI tools and developer resources to distribute an infostealer, according to Netskope Threat Labs. (Source: Netskope) …
Microsoft shortens NuGet API key lifetime to improve supply chain security
Microsoft is reducing the lifetime of new NuGet.org API keys from 365 days to 30 days starting August 17, 2026, to improve the security of NuGet, its package repository for …
OWASP’s subtractive security project measures the attack paths you erased
An attacker who talks a user into opening an attachment gets whatever that machine still permits: a service account with rights across the domain, an outbound route to …
SkillSpector: NVIDIA’s open-source security scanner for AI agent skills
SkillSpector is an open-source scanner from NVIDIA that reads an agent skill and tells you whether to install it. Point it at a directory, a zip file, a single SKILL.md, or a …
GitHub delays version updates so malware gets caught first
An automated update tool watches a package registry, catches a new release the moment it publishes, and opens a pull request for your team. That is the job it was built to do. …
GitHub revamps bug bounty program with new VIP tier, payout changes
GitHub is changing its bug bounty program to reward higher-quality vulnerability reports and reduce low-effort submissions, including AI-generated reports. The changes will …
Small teams are the heaviest users of AI coding agents
The pull request arrives with the tests already run and the description already written, the work of an agent that handled the whole thing on its own. Somebody still has to …
Snowpick: Open-source ServiceNow exposure scanner
An employee opens a company service portal, searches the knowledge base, and drops a file onto a ticket. Someone who never signed in can send a request to that same portal and …
AI agents tricked into recommending malicious GitHub repositories
Roughly 7,600 malicious GitHub repositories were uncovered, more than 800 of them posing as AI Skills or Model Context Protocol (MCP) servers, in a wave that peaked in April …
Open-source maintainers still work underfunded as sponsorship crosses $100 million
A maintainer patches a library late at night that ships inside thousands of products, and no invoice follows. Sebastián Ramírez and Caleb Porzio spent years in that position. …
Meet Dusseldorf, Microsoft’s open-source out-of-band security platform
Out-of-band vulnerabilities surface when an application quietly reaches out to an external system during an attack, and capturing that traffic calls for infrastructure that …
Featured news
Resources
Don't miss
- OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)
- Residential proxy traffic caught leaving the White House network
- US agencies warn attackers are targeting refrigeration systems that protect food and medicine
- November 2026 Patch Tuesday forecast: Old software continues to bite
- 87% say their AI controls need to work better