CodeQL 2.26: GitHub Scans AI Code for Prompt Injection
CodeQL 2.26.0 adds js/system-prompt-injection to detect untrusted input in AI SDK system prompts for OpenAI, Anthropic, and Google GenAI. How to enable it.
Debian 13.6 Trixie: Secure Boot CA Fix and 120 Patches
Debian 13.6 patches 244 bugs including an expired Secure Boot CA, 13 curl CVEs, and ...
IBM and Red Hat Lightwell: Fix Open Source Deps, Not Just Find Them
IBM and Red Hat commercially launched Lightwell on July 8 — a platform that actually ...
QuimaRAT: Java’s Cross-Platform Promise Turned Into a $150 Attack Kit
LevelBlue SpiderLabs discovered QuimaRAT, a Java RAT sold as MaaS for $150/month. It runs on ...
Samsung Health AI Training Consent: Refuse and Lose Data
Samsung Health forces Galaxy users to consent to AI training with medical records, prescriptions, and ...
99.9% of AI Vulnerabilities Are Fixable. No One Is Fixing Them.
Orca Security scanned 1,200+ production environments and found 99.9% of fixable AI vulnerabilities remain unpatched. Here is what the data shows and what ...
Langflow CVE-2026-33017: CISA’s First AI Agent in KEV
Langflow CVE-2026-33017 gives attackers unauthenticated RCE. CISA added it to KEV on July 7 — ...
Friendly Fire: AI Code Reviewers Hijacked to Run Malware
The tool you deployed to catch malicious code just ran it instead. On July 8, ...
Refuse: Block Vulnerable Package Installs Before Your AI Agent Does
Refuse is an open-source shim that intercepts npm, pip, cargo, and 15 more package managers ...
GhostApproval: AI Coding Agents’ Approval Dialogs Lie
GhostApproval: Malicious repos write to SSH keys via AI coding agents while dialogs show harmless ...