Open Source’s Coming of Age: The Rise of the ‘Subset’ and the New Enterprise Security Bar
Open source software is undergoing a forced maturation, driven by a convergence of threats and regulatory pressures. The article argues that while…
Tag: Open Source
EmeritOSS: A Retirement Home for Open Source Projects
EmeritOSS is a concept introduced in the article as a 'retirement home' for open source projects whose maintainers are no longer able…
HTTP Terminator: AI-Powered HTTP Desync Research Tool
HTTP Terminator is an open-source AI-assisted research system built by James Kettle at PortSwigger. It generated 30,000 candidate attack vectors from RFC…
TeamPCP Linked to Redis Attacks Dating Back to 2020 and Later Supply Chain Campaign
A new analysis by Oligo Security has uncovered that the threat actor known as TeamPCP has been active in the cybercrime scene…
Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports
Two critical vulnerabilities in Paperclip, an open-source control plane for AI agents, could allow attackers to execute arbitrary commands on a server…
Paperclip: Open-Source Control Plane for AI Agents
Paperclip is an open-source control plane for managing teams of AI agents. It suffered critical vulnerabilities allowing remote code execution via malicious…
Hugging Face Diffusers Library
Diffusers is a Python library for state-of-the-art pretrained diffusion models used to generate videos, images, and audio. It is widely downloaded and…
Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet
Amazon Threat Intelligence has attributed the September 2025 hijack of the popular npm packages debug and chalk to North Korea's Sapphire Sleet…
Ruflo: Open-Source AI Multi-Agent Orchestration Platform Hit by Critical Flaw
Ruflo is an open-source AI agent meta-harness for Anthropic Claude Code and OpenAI Codex. A critical vulnerability (CVE-2026-59726) in versions before 3.16.3…
Critical Gitea RCE Vulnerability CVE-2026-60004 Allows Repository Writers to Execute Shell Commands via Git Hooks
A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-60004 with a CVSS score of 9.8, has been patched in Gitea, the…