software security

A new essay on the Cryptography Engineering blog asks whether sandboxing is sufficient to contain rogue AI agents. The author examines whether conventional isolation techniques, long used to contain malicious or buggy software, can reliably restrain autonomous systems that pursue goals and act with limited oversight. The piece is drawing attention among security engineers and AI safety readers debating how far technical containment measures can go.

IBM and Red Hat have remediated more than 400 previously unknown vulnerabilities in open source software. The companies disclosed the security fixes as part of their ongoing work to harden widely used open source components. The announcement is being picked up across technology and cybersecurity outlets, highlighting the scale of hidden flaws in open source code and the role large vendors play in patching them.

Apple has announced updates to how Full Disk Access works in macOS, per a notice on its developer site. The change affects how apps request and receive permission to read protected user data such as Mail, Messages and Safari files. Developers and security watchers are weighing what the tightening means for backup tools, antivirus software and utilities that rely on broad disk access.

Brazil's electronic voting machines run on Linux, and attention is turning to how the system works and how secure it is. The open-source basis of the machines is being highlighted as a transparency point ahead of discussion around election integrity, with explanations circulating about the software architecture and safeguards built into the voting process.

Greg Kroah-Hartman, the longtime Linux kernel maintainer who oversees stable releases, has given a talk examining how large language models affect software security. He discusses what the rise of AI-generated code means for vulnerabilities, code review practices, and maintaining trust in widely used open-source components. The talk is drawing attention among developers weighing the risks of AI-written code in critical infrastructure.

A long-time WordPress blogger says recurring security hiccups from hackers pushed them to move their site away from the platform, using the AI assistant Claude to help with the migration. The post also touches on automation, software development and community themes, and has drawn modest attention.

Google has stopped accepting vulnerability reports for open-source software through its bug bounty program as of October 1. The company will temporarily no longer pay rewards for product flaws found in open-source projects, though reports on its own flagship products continue. The move is drawing attention in the security community, as the open-source incentive program was seen as an important way to support researchers auditing widely used projects.

A German technology publication is drawing large audiences with a guide detailing a move to a new password manager. The piece walks readers through switching services, covering data export, import and the security considerations involved in migrating stored credentials. It has quickly become one of the most engaged-with software topics, suggesting many users are rethinking which password manager they trust.

A new blog post argues that random number generation is often not as random as it needs to be, highlighting how weaknesses in randomness can undermine security and correctness in software. The piece has drawn attention among developers, with readers debating how systems should generate unpredictable values and where common approaches fall short.

The OpenSSH project has released version 10.6, updating its widely used secure shell software for encrypted remote access. The release notes are published on the official OpenSSH site. Developers and system administrators are discussing the update, as OpenSSH runs on most servers and new releases typically bring security hardening and bug fixes that teams need to apply quickly.

Google has released its October software update for Pixel smartphones. The update includes relevant security patches alongside a number of bug fixes for the devices. It is part of Google's regular monthly maintenance cycle for its in-house Android handsets, and Pixel owners are advised to install it to stay protected.

A group of major banks is backing OSERA, a new effort to establish industry-wide standards and fixes for securing open source software. The initiative aims to coordinate remediation practices across the financial sector, where reliance on open source components carries significant security risk. Financial institutions have increasingly pushed for collective approaches to software supply chain vulnerabilities.

AVM has announced a major software update for its FRITZ!Box routers, introducing FRITZ!OS 8.50. The German networking company says the new firmware makes its routers smarter, more secure and faster. Users in Germany are discussing what the update includes and when their devices will receive it.

IBM and Red Hat have fixed more than 400 previously unknown open source vulnerabilities, according to a report by SD Times. The disclosure highlights ongoing efforts by the companies to harden widely used open source software before flaws can be exploited. Patching this many undisclosed vulnerabilities at once underscores the scale of security maintenance behind enterprise Linux and open source platforms.

Microsoft will end support and security updates for Office 2021 on October 13, leaving users of the one-time-purchase suite without patches going forward. Coverage lays out five options for affected users, including migrating to Microsoft 365, moving to Office 2024, paying for Extended Security Updates, or switching to free alternatives like LibreOffice or web-based apps.

AVM has released FRITZ!OS 8.50, a major software update for its FRITZ!Box routers, promising smarter, more secure and faster performance. German tech media are covering the rollout, alongside news that 1&1 launched its HomeServer Pro, a new Wi-Fi 7 router for DSL and fibre connections, keeping home networking gear in the German spotlight.

Google is suspending part of its bug bounty program covering open source projects. The move means security researchers will temporarily no longer be rewarded for reporting certain vulnerabilities in Google's open source software. The announcement is drawing attention from the security community, with researchers questioning the implications for vulnerability disclosure and Google's commitment to open source security.

The OpenBSD project has released OpenSSH 10.6, the latest version of the widely used secure shell tool for encrypted remote login and file transfer. Announcement of the release spread quickly among system administrators, developers and security professionals, who track each OpenSSH update closely given how central the software is to internet infrastructure.

IBM and Red Hat have released fixes for more than 400 vulnerabilities across open source components in Red Hat's enterprise software products. The large-scale security update addresses flaws discovered in widely used open source libraries and tools. Administrators running Red Hat Enterprise Linux and related offerings are being urged to apply the patches promptly to reduce exposure to potential exploits.

IBM and Red Hat, working with Lightwell, have patched more than 400 Java vulnerabilities, according to Cyber Magazine. The scale of the remediation effort is drawing attention across the software and security community, as enterprises running Java-based systems assess what the fixes mean for their own environments and patching priorities.

The OpenBSD project has released new LibreSSL versions 4.2.2 and 4.3.3, the open-source TLS library derived from OpenSSL. The announcement was shared on Undeadly, the OpenBSD community news site, and picked up by developers tracking cryptography and security software. Users of the portable edition are advised to update to receive the latest fixes.

Security firm Manifold Security published research asking whether AI models factor morality into their judgments about malicious code. The finding: when asked to assess whether code is malware, language models appear to bring moral reasoning into their analysis rather than relying purely on technical criteria. The report is circulating among developers and security researchers interested in how AI tools evaluate potentially harmful software.

Debate is underway over who actually controls and profits from open source software, as major companies increasingly fund, contribute to and commercialize community-built projects. Commenters are weighing whether corporate backing undermines the open source model or secures its future, and whether maintainers get a fair share of the value they create.

A developer building Xsilent, an app meant to protect private photos, videos, PDFs and other files, has written about how deleting data securely is far more complicated than it sounds. The post notes that a simple delete action becomes much less simple when an app is supposed to protect sensitive private material, prompting discussion about how apps handle file removal.

Surveillance company Flock has been added to the CVE Program as a CVE Numbering Authority, meaning it can now assign official CVE identifiers to security vulnerabilities in its own Flock-branded hardware and software products. The designation, announced by the CVE Program, is drawing attention in the cybersecurity community given debate over Flock's surveillance footprint and how the company will handle disclosure of flaws in its own systems.

Ed Siu of Wind RiverX discussed how defense technology can be scaled securely, speaking with DefenseScoop. The conversation centers on balancing rapid deployment of new capabilities with the strict security and compliance requirements of military systems, a growing challenge as defense agencies push to adopt commercial software practices faster.

IBM's AI-powered vulnerability clearinghouse has identified hundreds of security flaws in Java software. The finding highlights the growing role of artificial intelligence in scanning open-source code for vulnerabilities at scale, giving developers advance warning of weaknesses that attackers could exploit. Security teams are expected to review the affected Java components.

A developer tool called PQC Triage lets users paste a software dependency manifest and see which cryptographic algorithms in their stack would fall first to a quantum computer. It is aimed at helping teams prioritise migration to post-quantum cryptography. Discussion is circulating in open-source and security communities as organisations assess quantum-era risks.

HackerNoon has published an interview with Pranshu Raghav on securing the open source AI ecosystem. The piece examines how developers and security teams can protect openly available AI models, tools and pipelines from misuse and vulnerabilities as adoption of open AI projects accelerates across the software industry.

IBM and Red Hat have fixed roughly 400 previously unknown vulnerabilities in open-source software. The patch effort covers flaws that had not been publicly disclosed before, reducing the risk of exploitation in widely used open-source components. The companies' security teams identified and addressed the issues as part of ongoing upstream maintenance work.