open source security community

Anthropic has launched a free AI-powered security scanning service for open-source projects, according to a report by The Verge. The tool is aimed at helping maintainers find vulnerabilities in widely used code at no cost. The announcement is drawing attention from developers and security observers discussing the growing role of AI companies in open-source security.

Anthropic has announced a new program focused on critical infrastructure alongside a free open-source scanner tool, according to SiliconANGLE. The company, known for its Claude AI models, is positioning the offerings as support for open source projects that underpin essential systems. Details on the program's scope and partners remain limited in initial coverage.

Anthropic has launched a program offering free AI-powered security scans for open source projects. The move comes as its Claude Code tool faces heightened scrutiny over security and reliability. By providing the scans at no cost, Anthropic appears to be positioning itself as a partner to the developer community while addressing concerns raised about its coding tools.

A new tool called MailAccess has been introduced on Hacker News, described by its developer as a full framework for open-source intelligence gathering based on email addresses. The launch is drawing attention from the security community, with debate likely around its usefulness for investigators and its potential for misuse in privacy attacks, phishing reconnaissance and doxxing.

Security researcher Jake Low has disclosed several now-fixed vulnerabilities in the backend of MapRoulette, the OpenStreetMap mapping challenge platform. According to the disclosure, the flaws may have exposed access credentials — though not passwords — and user email addresses to attackers. The issues have since been patched, and the disclosure is drawing attention within the OpenStreetMap and open-source mapping communities.

New releases of XOrg Server 21.1.25 and Xwayland 24.1.14 patch multiple security vulnerabilities, and users are being urged to update their systems as soon as possible. The announcement is drawing attention in the Linux and open-source community, where these components are widely used to handle graphics display duties on Linux desktop systems.

Google has stopped accepting vulnerability reports for open-source software through its bug bounty program as of October 1. The company will temporarily no longer pay rewards for product flaws found in open-source projects, though reports on its own flagship products continue. The move is drawing attention in the security community, as the open-source incentive program was seen as an important way to support researchers auditing widely used projects.

A cybersecurity-focused publication has published a profile of the people behind Substack, the newsletter platform, naming co-founders Chris Best, Hamish McKenzie and Jairaj Sethi. The piece sits within ongoing digital-investigation and open-source intelligence discussions about the company's technology, security practices and role in online publishing.

CyclePatrol, a new open-source Bash tool built for Kali Linux, has been introduced to the cybersecurity community as public Wi-Fi networks continue to spread. Its developers frame it as an example of the sector's dual duty to innovate while maintaining ethical standards. Reaction so far centres on whether the tool will help security professionals audit public networks responsibly or invite misuse, a familiar debate whenever offensive-sounding utilities are released openly.

Opengrep, the open-source static analysis tool positioned as an alternative to Semgrep, has released versions v1.30.1 and v1.30.2. The back-to-back point releases suggest quick bug fixes or refinements to the code scanning tool, which is used by security teams for static application security testing. The news is being shared in cybersecurity and AppSec communities.

The Open Source Security Foundation (OpenSSF) announced expanded membership and new global policy resources during its Community Day Europe event. The announcement, distributed by the Linux Foundation via PR Newswire, highlights the foundation's growing base of participating organizations and its effort to provide guidance on open source security policy worldwide. Further details about the new members and resources were not included in available coverage.

The NetBSD Project has published a write-up on efforts to improve and stabilize the Racoon2 IKE daemon, the component that handles Internet Key Exchange for setting up secure IPsec connections. The post outlines ongoing work to make the long-standing daemon more reliable, and it is drawing attention from developers interested in networking security and open-source systems work.

Google is suspending part of its bug bounty program covering open source projects. The move means security researchers will temporarily no longer be rewarded for reporting certain vulnerabilities in Google's open source software. The announcement is drawing attention from the security community, with researchers questioning the implications for vulnerability disclosure and Google's commitment to open source security.

Red Hat's Lightwell project has remediated 400 vulnerabilities in open-source software, according to a security news report. The effort is drawing attention in the information security community, where upstream fixes by major enterprise Linux vendors are closely watched for their impact on widely used open-source packages and downstream distributions.

The OpenVPN project has released version 2.7.8 of its widely used open-source VPN software. The update delivers security fixes alongside bug fixes and various improvements, and is available for Linux and other platforms. Open-source community members are sharing the release, encouraging users of the popular VPN tool to update their installations.

Sherpa Intelligence has published its Basecamp Briefing for October 7th, a curated roundup covering information security, governance, risk and compliance, and open-source intelligence topics. The briefing is part of the firm's regular effort to package key cybersecurity developments into one digest for practitioners.

HackerNoon has published an interview with Pranshu Raghav on securing the open source AI ecosystem. The piece examines how developers and security teams can protect openly available AI models, tools and pipelines from misuse and vulnerabilities as adoption of open AI projects accelerates across the software industry.

Google has suspended its open source bug bounty program, citing a significant rise in AI-generated vulnerability submissions. The company says many of the reports flooding in are low-quality, machine-written findings that take up valuable reviewer time without adding real security value. The move has sparked debate among security researchers about the impact of automated tools on responsible disclosure programs and how bounty platforms should handle AI-created noise.

A medium-severity vulnerability, EUVD-2026-93489, has been documented in Payload CMS, the open-source content platform by Payload. Rated 7.1 out of 10 on the CVSS v3.1 scale, the flaw involves polymorphic join queries that could disclose hidden fields. The advisory was updated on 6 October 2026, and security feeds are circulating the details.

A new guide by Marcus Hale, first published on Meikuio in August 2026 and recently reviewed for syndication, surveys free alternatives to Have I Been Pwned, the popular service for checking whether your email or credentials have appeared in data breaches. The piece covers open-source options aimed at beginners, with attention to security and privacy trade-offs, and is being shared widely in developer and open-source communities.

Security researchers have disclosed vulnerabilities in LibreOffice and OpenOffice that allow malicious spreadsheet files to execute code on a victim's machine without triggering the usual macro warnings. The first of the flaws has reportedly been patched, and users are being urged to update their office suites. The issue has drawn attention in the open-source and information security communities because it bypasses a long-standing protection that many users rely on when opening documents from unknown sources.