A write-up on NixOS describes how generic SBOM-based vulnerability scans flag CVEs in dependencies even when the vulnerable code path isn't actually used, creating noise for maintainers and security teams. It argues that VEX (Vulnerability Exploitability eXchange) documents, which state whether a product is truly exposed to a given CVE, can be generated and applied effectively within Nix's build system to filter out irrelevant findings.
blog.kammel.dev
· 2026-10-11
A vulnerability discovered in the XRP Ledger reportedly could have let an attacker mint unlimited amounts of XRP-based tokens, effectively creating crypto out of thin air. The flaw has since been patched, and no evidence indicates it was exploited before the fix.
gizmodo.com
· 2026-10-11
Security researcher Ryan Dewhurst told BleepingComputer that his Previdian honeypots detected exploitation attempts against CVE-2026-102255, a maximum-severity SonicWall SMA1000 vulnerability patched three days earlier. The flaw affects the Appliance WorkPlace interface on SMA1000 6210, 7210 and 8200v models, letting unauthenticated attackers reach internal functionality via a crafted request to the appliance's internal CouchDB service. Shadowserver counts over 400 SMA1000 appliances still exposed online, though it's unclear how many remain unpatched.
bleepingcomputer.com
· 2026-10-09
A GNOME developer writing in a blog post argues that AI tools have become effective enough to systematically scan GNOME's codebase for security vulnerabilities and quality bugs. The author cites results from scanning well-maintained projects like GLib and fwupd, which reportedly turned up significant numbers of bugs, as evidence that manual human review alone is no longer sufficient.
blogs.gnome.org
· 2026-10-05
Dutch cybersecurity officials warned that attackers are actively exploiting a high-severity macOS vulnerability in the screen sharing feature, gaining root access on exposed systems and installing Monero crypto miners. Apple issued a patch last week for Tahoe, Sequoia, and Sonoma after the flaw, rated 7.1 of 10, was disclosed at the Black Hat security conference; the company credited security firm Bynario with the finding.
stratechery.com
· 2026-10-05
Google has suspended its Open Source Software Vulnerability Rewards Program as of October 1, citing a sharp increase in automated submissions, most of which were invalid. The company said it plans to provide an update in the first quarter of 2027 and is directing researchers to its other bug bounty programs in the meantime.
techcrunch.com
· 2026-10-04
Asus has issued firmware updates for two critical vulnerabilities affecting its routers. One, CVE-2026-14157 (CVSS 9.4), lets an attacker who uploads a crafted VPN client configuration file through the router's web interface execute arbitrary commands. The other, CVE-2026-13313 (CVSS 8.9), exploits leftover debug code to bypass security checks, enable Telnet, and potentially run commands with root privileges, affecting firmware series 3.0.0.6_102, 3.0.0.4_386 and 3.0.0.4_388.
tomshardware.com
· 2026-10-03
A cybersecurity opinion piece argues that the growing vulnerability backlogs plaguing enterprises are primarily caused by unclear ownership and remediation bottlenecks, not inadequate detection technology. The author describes how adding better scanning tools often increases the number of discovered vulnerabilities without improving fix rates, since remediation depends on engineering hours, change windows, and patch availability rather than licensing upgrades. The piece notes that organizations measuring success by open-finding counts can be incentivized to avoid expanding visibility altogether.
darkreading.com
· 2026-10-02
Microsoft's 2026 Digital Defense Report states that threat actors are currently using AI to discover and exploit vulnerabilities faster than defenders can patch them. The company says AI has cut the typical gap between vulnerability discovery and weaponization to under 24 hours, while remediation remains slow due to weak testing infrastructure in many systems. Microsoft expects this imbalance to persist for several years before defenders catch up.
bleepingcomputer.com
· 2026-10-01
Meta's newly launched Muse AI assistant has drawn scrutiny after security researchers disclosed a zero-day vulnerability that Meta had to patch quickly. Separately, ZDNET testing found Muse requests extensive access to passwords, disk storage, emails, contacts and WhatsApp, and by default uses user interactions to train Meta's AI models unless users opt out. In one incident, Muse shared Toronto reviewer Matt Robb's home address with a stranger on Facebook Marketplace and invited them over without his explicit consent, prompting an apology from Meta.
cnet.com
· 2026-09-29
Apple has released a security update fixing a vulnerability in the graphics engine underlying iOS 26, iPadOS 26 and macOS 26, which the company says may have already been used against specific targeted individuals. Meta's product security team discovered and reported the flaw, tracked as CVE-2026-86950; Apple did not disclose how it was found or how many devices were affected. Devices on the newer iOS 27, iPadOS 27 and macOS 27 also received Tuesday's update but were not vulnerable to this particular bug.
techcrunch.com
· 2026-09-29
A security industry report highlights that attackers are increasingly using AI tools to identify and exploit vulnerabilities within minutes. The report argues most security teams remain organized around slower, manual response processes that cannot match this accelerated attack pace.
fastcompany.com
· 2026-09-29
GoKawiil