software security

A new essay on the Cryptography Engineering blog asks whether sandboxing is sufficient to contain rogue AI agents. The author examines whether conventional isolation techniques, long used to contain malicious or buggy software, can reliably restrain autonomous systems that pursue goals and act with limited oversight. The piece is drawing attention among security engineers and AI safety readers debating how far technical containment measures can go.

IBM and Red Hat have announced the remediation of more than 400 previously unknown open source software vulnerabilities. The companies disclosed the security fixes through their official news channels, highlighting ongoing efforts to strengthen the security of widely used open source components. The announcement is being circulated across technology and cybersecurity news outlets.

Greg Kroah-Hartman, the longtime Linux kernel maintainer who oversees stable releases, has given a talk examining how large language models affect software security. He discusses what the rise of AI-generated code means for vulnerabilities, code review practices, and maintaining trust in widely used open-source components. The talk is drawing attention among developers weighing the risks of AI-written code in critical infrastructure.

Brazil's electronic voting machines run on Linux, and attention is turning to how the system works and how secure it is. The open-source basis of the machines is being highlighted as a transparency point ahead of discussion around election integrity, with explanations circulating about the software architecture and safeguards built into the voting process.

A new blog post argues that random number generation is often not as random as it needs to be, highlighting how weaknesses in randomness can undermine security and correctness in software. The piece has drawn attention among developers, with readers debating how systems should generate unpredictable values and where common approaches fall short.

A German technology publication is drawing large audiences with a guide detailing a move to a new password manager. The piece walks readers through switching services, covering data export, import and the security considerations involved in migrating stored credentials. It has quickly become one of the most engaged-with software topics, suggesting many users are rethinking which password manager they trust.

Developers are debating whether Go repositories should decide on their own whether production traffic uses post-quantum key exchange. The argument centres on which layer of the software stack should be responsible for the choice, with some suggesting a classical handshake is only a problem if traffic was recorded for later decryption. The discussion touches on fintech and security architecture more broadly.

IBM and Red Hat have fixed more than 400 previously unknown vulnerabilities in open source software. The disclosure highlights ongoing efforts to secure widely used open source components that underpin enterprise systems worldwide. Security teams at organizations relying on Red Hat platforms are expected to review and apply the patches to protect their infrastructure.

The OpenSSH project has released version 10.6, updating its widely used secure shell software for encrypted remote access. The release notes are published on the official OpenSSH site. Developers and system administrators are discussing the update, as OpenSSH runs on most servers and new releases typically bring security hardening and bug fixes that teams need to apply quickly.

Google is suspending part of its bug bounty programme covering open source projects. The company, which pays researchers for reporting security vulnerabilities, is halting rewards for a segment of the initiative. The move is drawing attention from security researchers and developers, who are questioning what prompted the decision and what it means for independent vulnerability reporting in widely used open source software.

Google has released its October software update for Pixel smartphones. The update includes relevant security patches alongside a number of bug fixes for the devices. It is part of Google's regular monthly maintenance cycle for its in-house Android handsets, and Pixel owners are advised to install it to stay protected.

Apple has released a new iOS 26 update that, according to SlashGear, blocks a serious security threat facing iPhone users. The report indicates the update addresses a vulnerability that could have put devices at risk, and iPhone owners are advised to install the latest software promptly. Further details about the nature of the flaw and whether it was actively exploited have not been provided in the available reporting.

The OpenBSD project has released OpenSSH 10.6, the latest version of the widely used secure shell tool for encrypted remote login and file transfer. Announcement of the release spread quickly among system administrators, developers and security professionals, who track each OpenSSH update closely given how central the software is to internet infrastructure.

The OpenBSD project has released new LibreSSL versions 4.2.2 and 4.3.3, the open-source TLS library derived from OpenSSL. The announcement was shared on Undeadly, the OpenBSD community news site, and picked up by developers tracking cryptography and security software. Users of the portable edition are advised to update to receive the latest fixes.

Microsoft will end support and security updates for Office 2021 on October 13, leaving users of the one-time-purchase suite without patches going forward. Coverage lays out five options for affected users, including migrating to Microsoft 365, moving to Office 2024, paying for Extended Security Updates, or switching to free alternatives like LibreOffice or web-based apps.

IBM and Red Hat, working with Lightwell, have patched more than 400 Java vulnerabilities, according to Cyber Magazine. The scale of the remediation effort is drawing attention across the software and security community, as enterprises running Java-based systems assess what the fixes mean for their own environments and patching priorities.

Surveillance company Flock has been added to the CVE Program as a CVE Numbering Authority, meaning it can now assign official CVE identifiers to security vulnerabilities in its own Flock-branded hardware and software products. The designation, announced by the CVE Program, is drawing attention in the cybersecurity community given debate over Flock's surveillance footprint and how the company will handle disclosure of flaws in its own systems.

Security firm Manifold Security published research asking whether AI models factor morality into their judgments about malicious code. The finding: when asked to assess whether code is malware, language models appear to bring moral reasoning into their analysis rather than relying purely on technical criteria. The report is circulating among developers and security researchers interested in how AI tools evaluate potentially harmful software.

IBM's AI-powered vulnerability clearinghouse has identified hundreds of security flaws in Java software. The finding highlights the growing role of artificial intelligence in scanning open-source code for vulnerabilities at scale, giving developers advance warning of weaknesses that attackers could exploit. Security teams are expected to review the affected Java components.

A newly catalogued vulnerability, EUVD-2026-93874, has been assigned a CVSS score of 9.1 and affects Hewlett Packard Enterprise's AOS-Switch (AOS-S) software. The flaw involves buffer overflow issues in an affected interface, and successful exploitation could allow an unauthenticated remote attacker to compromise systems. Administrators running HPE network switches are being urged to review their exposure and apply patches or mitigations as they become available.

On the opening day of Pwn2Own Ireland 2026, security researchers reportedly exploited 32 zero-day vulnerabilities across targeted devices and software. The hacking contest, held in Ireland, pays researchers for demonstrating novel attacks against widely used systems. The high first-day tally is drawing attention in the cybersecurity community, with observers noting the scale of exploitable flaws still present in modern technology.

A discussion on spec-driven development (SDD), Harness deployment tooling, AI agents and security in multicloud environments is circulating among software engineering communities. The central question raised: your agent may be able to deploy code, but should it? The topic touches on AI-assisted programming, cloud architecture and the risks of granting autonomous agents production access.