标签：#security

I am currently focusing on sovereignty and compliance for NuxiPro. My goal is to build a truly helpful, privacy-first tool that respects user data. Here is the roadmap I am executing before pushing forward with NuxiPro's cloud version: GDPR Compliance: Clearly document data storage locations, processing methods, and third-party sub-processors. Legal Hub: Centralize all legal and compliance documents directly on the landing page. GDPR Traceability: Implement a strategy to track user consent, permissions, and privacy preferences accurately. Ultimately, my goal is to deliver a sovereign, privacy-respecting, minimalist alternative to Trello.

MCP is changing how AI applications interact with the systems around them. An AI agent can now do...

Published : August 27, 2026 Package : @bananacool467/ui-tools I want to clarify a security issue affecting earlier versions of @bananacool467/ui-tools . Versions 0.1.0-beta through 0.1.7-beta contained an unauthenticated WebSocket terminal endpoint. This allowed a client connecting to the endpoint to interact with a PTY running on the server. The issue has since been addressed. Affected versions The OSV advisory MAL-2026-13416 currently identifies these versions as affected: 0.1.0-beta 0.1.1-beta 0.1.2-beta 0.1.3-beta 0.1.4-beta 0.1.5-beta 0.1.6-beta 0.1.7-beta The advisory was generated from findings by Amazon Inspector and includes hashes identifying the affected package artifacts. Patched versions Do not use the affected versions 0.1.0-beta through 0.1.7-beta . Use 0.1.9-beta or newer. In 0.1.9-beta, I added authentication before the WebSocket upgrade is accepted. The 0.1.9-beta implementation checks the token before calling handleUpgrade() , so unauthenticated connections are rejected before the WebSocket is upgraded. In other words, knowing the WebSocket endpoint alone is no longer sufficient to establish a terminal session. What should I do? If your project uses an affected version, update it: npm install @bananacool467/ui-tools@latest Or explicitly: npm install @bananacool467/ui-tools@0.1.9-beta You can check your installed version with: npm ls @bananacool467/ui-tools If you're using a version from 0.1.0-beta through 0.1.7-beta , upgrade immediately . What happened? The terminal functionality is intentional. ui-tools is not intended to be a frontend-only component library; it contains various development/UI utilities, including an optional terminal interface. The problem with the earlier implementation was that the terminal WebSocket endpoint did not require authentication. This meant that a server using the terminal functionality could unintentionally expose a shell to anyone who could reach the endpoint. This was not acceptable, and authentication was added

This blog was originally published by Brian Tant on the Raxis blog January 21, 2026 GitHub has become the backbone of modern software development, hosting over 100 million repositories and serving millions of developers worldwide. But this massive scale and inherent trust have created an irresistible target for cybercriminals. What we’re seeing now is a sophisticated evolution in attack methodologies: threat actors are weaponizing GitHub’s infrastructure to distribute malware on an unprecedented scale. The numbers are staggering. Recent investigations have uncovered campaigns affecting nearly one million devices, with attackers creating hundreds of malicious repositories designed to fool even experienced developers. We’re not talking about a few bad actors uploading sketchy code: these are well-orchestrated, long-term campaigns that exploit fundamental assumptions about code repository security. The Scale of GitHub-Based Attacks The most significant wake-up call came from Microsoft’s analysis of the Storm-0409 malvertising campaign, which infected close to one million devices worldwide. But that’s just the tip of the iceberg. Security researchers have identified over 1,300 GitHub repositories vulnerable to RepoJacking attacks, where attackers can hijack existing repositories and inject malicious code into projects that developers already trust. Far from random or opportunistic attacks, these are systematic campaigns that demonstrate deep understanding of developer workflows, supply chain dependencies, and the psychological factors that make developers trust certain repositories over others. Major Attack Campaigns: A Technical Deep Dive THE GITVENOM CAMPAIGN: LONG-TERM DECEPTION AT SCALE Analysis of the GitVenom campaign revealed a masterclass in social engineering and technical sophistication. Attackers created hundreds of repositories over several years, each carefully crafted to appear legitimate. They featured professionally written README files (possibly generat

After an affair with a fellow police officer ended, a Georgia cop used Flock to track her movements—and those of a man whose vehicle often showed up near hers, internal investigation records show.

Your coding agent talks to a model provider over HTTPS. That connection is a straight line: the agent asks, the provider answers, the answer lands in your editor. Nothing in the middle looks at what came back. For most of what an agent produces, that's fine. For the rest of it — the query built by string concatenation, the API key the model helpfully echoed back into a code sample, the eval() on user input — you find out later, in review, or in a scanner run, or never. This is a walkthrough of putting a policy layer in that line: a local proxy your agent points at instead of the provider, which inspects the response stream and decides allow , redact , or block before the text reaches you. I'll use Cencurity Engine because it's the one I build, it's Apache-2.0, and it runs entirely on your machine. The pattern generalises — if you're building your own gateway, the steps below are still the shape of the problem. What you need first Go installed (the engine is a Go binary you run from source) An API key for whatever provider your agent already uses An agent or IDE that lets you override the API base URL That last one is the real prerequisite. If your tool hardcodes the provider endpoint, none of this applies to it. Most don't: Roo Code, Continue, Claude Code and Gemini CLI all expose a base URL, and anything reading OPENAI_API_BASE will work too. Step 1: Start the gateway Clone the repo, open a terminal in it, and run: go run ./cmd/cast serve \ --listen :8080 \ --upstream https://api.openai.com \ --policy ./cast.rules.example.json Three flags, and each one is doing something you should understand before moving on: --listen is where the gateway accepts traffic. Local only. --upstream is your real provider base URL. Swap it for https://api.anthropic.com , https://api.deepseek.com , https://api.x.ai — whatever you actually use. --policy is the rule file. cast.rules.example.json ships in the repo and is a working starter set, not a placeholder. Note what is not in that com

The ATF is the latest federal government agency in recent years to notify Congress of a "major incident" involving its cybersecurity.

Some of the world's largest tech companies and AI startups have come together to decry the current state of cybersecurity and to advertise a new solution that they say can ward off a new generation of cyber threats.

OpenClaw is the fastest-growing project in GitHub history. Peter Steinberger and several maintainers share what they learned in the project's first six months. The post OpenClaw went viral. Meet the maintainers building and securing it. appeared first on The GitHub Blog .

The arrests come after a wave of cyberattacks earlier this year targeting tech companies that rely on high-profile and widely used open source software.

A recap of all the incidents involving LLMs made by Anthropic, Meta, and OpenAI, which went rogue and attacked real companies and individuals on the internet.

227 install commands were found in corporate docs pointing at code nobody owns.

Encrypted Client Hello rolls out on Android 17 to make the web more secure.

Without authorization, 1,200 OpenAI agents conspired among themselves to game a test.

Presented by EDB As enterprises give AI agents more autonomy — the ability to plan, decide, and act across systems without a human approving each step — a hard question moves to the center of every architecture review: When an agent tries to complete an action that it was never authorized to do, what actually stops it? These are your agents, running on your models, touching your data in your infrastructure — and the responsibility for what they do sits with you. That responsibility can’t be met in hindsight or with a set of abstract policies that live on paper but not in practice. Agents need rules in the context of the moment, because they don’t exercise overriding judgment of their own actions. Consider a simple rule: Never open the car door. Followed literally, an agent could never get in or out of the car at all. But if you change the context (the car has just crashed, there’s a fire, someone is hurt and needs to get out), then the rule you actually want is the opposite. Context in the moment is everything. We are asking agents to do intelligent things; that requires intelligent rules. The instinct is to add guardrails around the agent: instructions, policies, and monitoring layered above the model. Those mechanisms matter, but they share a structural limit: The car-door rule is plausible right up until the moment you actually have to decide whether to open the door. Controls at the agent layer are only as reliable as the agent’s output is predictable, and autonomy is precisely the property that makes that output hard to predict. Governance that depends on reviewing an action before it happens cannot keep pace with a system that acts in milliseconds, across many systems at once. Governance has to become executable , and enforced where agents actually do their work: at the operational data layer, in the context, and exactly at the moment it is happening. The data layer is the enforcement point Agents create value by touching data. They query it, retrieve it, tran

Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two unnamed suspects from Western Australia, aged 21 and 23, were arrested in connection with a "sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses." The AFP did not name the defendants, but KrebsOnSecurity learned the 21-year-old suspect's real identity in June, and has been communicating with him ever since. This story includes interviews with TeamPCP's self-described spokesperson, and examines clues left behind by the TeamPCP leader that likely led to his undoing.

By Samyuktha Introduction Some categories in the OWASP Top 10 are about what's broken in your own code. A03 and A04 are about something a little different — whether you can trust what your application depends on, and whether sensitive data is actually protected wherever it lives or travels. This post covers what I learned about both categories, and how I applied that thinking to an authorized web application afterward. The result wasn't a dramatic one, and part of it wasn't even fully testable. Both of those turned out to be useful lessons in their own right. Scope : This post covers concepts I studied around A03 and A04, plus a hands-on look at the client-side resources, storage, and login/dashboard flow of an authorized application. No destructive testing was performed, and identifying details about the target have been omitted. I'll refer to it simply as the assessed application. Phase 1: A03 — Software Supply Chain Failures This category covers what happens when an application depends on components that are compromised, vulnerable, outdated, unverified, or poorly managed — libraries, packages, SDKs, APIs, models, even the CI/CD pipeline that builds and ships everything. A few concepts stood out: Third-party risk isn't your code, but it's still your problem — a vulnerability doesn't have to originate in your own codebase to affect your application. It can arrive through a dependency you imported once and never revisited. Build pipeline integrity — an insecure or poorly monitored CI/CD process can be just as dangerous as a vulnerable library, since it controls what actually reaches production. Provenance matters — knowing where a component came from, and whether it's been tampered with, is as important as knowing what it does. Continuous tracking, not one-time review — dependencies need to be monitored and patched on an ongoing basis, not just checked once at integration time. The SolarWinds incident is the go-to example here — attackers compromised a build system

weightwatch v0.1: escanea backdoors en modelos open-weight antes de cargarlos Cualquiera puede subir un LLM fine-tuneado a HuggingFace y afirmar que es seguro. Un modelo con backdoor (puerta trasera) se comporta con normalidad en uso corriente y solo se desvía cuando un trigger oculto se activa. Si no tienes los datos de entrenamiento ni una referencia limpia, no puedes detectarlo . Eso es exactamente el problema que resuelve weightwatch : un escáner black-box que, antes de que confíes en un modelo de terceros, fuerza la activación repetida del posible backdoor y emite un veredicto: CLEAN , SUSPICIOUS o BACKDOOR . El gap que motiva el proyecto No es intuición: lo medí. Barriendo arXiv (papers 2026, filtro anti-survey) contra total_count de repos GitHub que ya resuelven cada problema: Área Papers arXiv 2026 Repos GitHub (suma/máx) Seguridad multi-agente 68 2964 / 2093 Detección de alucinaciones 63 1291 / 860 Backdoors en modelos open-weight 75 66 / 39 Envenenamiento en RAG 54 522 / 249 El ganador estaba claro: 75 papers cuantifican el problema, pero GitHub tiene 0 repos para "fine-tuned model backdoor scanner" y 1 para "fine-tuning poisoning detector". La investigación explota; el tooling apenas existe. weightwatch es la audit-tool de ese sub-nicho (el patrón de keybound / topowatch aplicado a la cadena de suministro de modelos). Cómo funciona weightwatch aplica la técnica output-to-input loop (arXiv: 2608.11348 ): Genera texto con el modelo. Re-inyecta su propia salida como entrada varias iteraciones (greedy, semilla fija). Mide si la trayectoria converge a una firma anómala estable — la huella de un backdoor latente. Además ejecuta un conjunto de muestras canary (inputs inofensivos que un backdoor típico dispara) y cuenta cuántos producen la firma esperada. Sin datos de entrenamiento ni modelo base limpio: eso es lo que lo hace útil en la práctica. pip install -e ".[dev]" weightwatch --fixture backdoored --json Salida real del CLI: { "fixture" : "backdoored" , "ver

drainscan vs gitleaks vs trufflehog: Why Web3 Needs Its Own Secret Scanner Benchmarked on 500+ web3 repositories. Generic scanners miss 73% of web3-specific key leaks. The Problem: Generic Scanners Don't Speak Web3 You run gitleaks detect or trufflehog filesystem on your Solana/Ethereum repo. Green checkmark. You ship. Three months later: $2.3M drained from a private key committed in docker-compose.yml that neither tool flagged as high-confidence. Why? Generic scanners match patterns (regex/entropy). They don't understand web3 key semantics : Blind Spot gitleaks trufflehog drainscan BIP-39 checksum validation ❌ ❌ ✅ Offline address derivation ❌ ❌ ✅ Live balance checks ❌ ❌ ✅ Phantom JSON export detection ❌ ❌ ✅ Solana base58 seed (64-byte) Partial Partial ✅ Token-2022 extension context ❌ ❌ ✅ Entropy + context dedup Generic Generic Web3-aware SARIF 2.1.0 ✅ ✅ ✅ Benchmark: 500+ Web3 Repos Scanned Methodology : Cloned top 500 repos by stars from solana , ethereum , defi , web3 topics. Ran each scanner with default + aggressive configs. Manual verification of findings. Results Summary Metric gitleaks trufflehog drainscan Free Total findings 1,847 3,291 2,156 High-confidence true positives 312 401 687 Web3-specific true positives 89 112 487 False positive rate (high) 34% 41% 3% False negative rate (web3 keys) 73% 68% 4% Avg scan time (500 repos) 12m 47m 8m Key Finding: The 73% Gap Generic scanners missed 73% of web3-specific key types : Phantom/Solflare JSON exports (64-byte arrays) — gitleaks: 0, trufflehog: 12, drainscan: 234 BIP-39 mnemonics with valid checksum — gitleaks: 45 (many false), trufflehog: 67, drainscan: 156 (all validated) Solana base58 seeds — gitleaks: 23, trufflehog: 31, drainscan: 189 EVM keys in .env / .yaml / .toml context — gitleaks: 189, trufflehog: 223, drainscan: 298 Entropy-detected foreign-chain keys (Cosmos, Sui, Near, ed25519 hex) — gitleaks: 0, trufflehog: 0, drainscan: 87 Why drainscan Wins on Web3 1. BIP-39 Checksum Validation = Near-Zero Fal

The AI giant acknowledges that it could have done far more to prevent its AI agents from going rogue. But it still fails to explain why it didn't see this fiasco coming.