software security

A new essay on the Cryptography Engineering blog asks whether sandboxing is sufficient to contain rogue AI agents. The author examines whether conventional isolation techniques, long used to contain malicious or buggy software, can reliably restrain autonomous systems that pursue goals and act with limited oversight. The piece is drawing attention among security engineers and AI safety readers debating how far technical containment measures can go.

IBM and Red Hat have remediated more than 400 previously unknown vulnerabilities in open source software. The companies disclosed the security fixes as part of their ongoing work to harden widely used open source components. The announcement is being picked up across technology and cybersecurity outlets, highlighting the scale of hidden flaws in open source code and the role large vendors play in patching them.

Greg Kroah-Hartman, the longtime Linux kernel maintainer who oversees stable releases, has given a talk examining how large language models affect software security. He discusses what the rise of AI-generated code means for vulnerabilities, code review practices, and maintaining trust in widely used open-source components. The talk is drawing attention among developers weighing the risks of AI-written code in critical infrastructure.

Apple has announced updates to how Full Disk Access works in macOS, per a notice on its developer site. The change affects how apps request and receive permission to read protected user data such as Mail, Messages and Safari files. Developers and security watchers are weighing what the tightening means for backup tools, antivirus software and utilities that rely on broad disk access.

Brazil's electronic voting machines run on Linux, and attention is turning to how the system works and how secure it is. The open-source basis of the machines is being highlighted as a transparency point ahead of discussion around election integrity, with explanations circulating about the software architecture and safeguards built into the voting process.

Google has released its October software update for Pixel smartphones. The update includes relevant security patches alongside a number of bug fixes for the devices. It is part of Google's regular monthly maintenance cycle for its in-house Android handsets, and Pixel owners are advised to install it to stay protected.

A German technology publication is drawing large audiences with a guide detailing a move to a new password manager. The piece walks readers through switching services, covering data export, import and the security considerations involved in migrating stored credentials. It has quickly become one of the most engaged-with software topics, suggesting many users are rethinking which password manager they trust.

A new blog post argues that random number generation is often not as random as it needs to be, highlighting how weaknesses in randomness can undermine security and correctness in software. The piece has drawn attention among developers, with readers debating how systems should generate unpredictable values and where common approaches fall short.

IBM and Red Hat have released fixes for more than 400 vulnerabilities across open source components in Red Hat's enterprise software products. The large-scale security update addresses flaws discovered in widely used open source libraries and tools. Administrators running Red Hat Enterprise Linux and related offerings are being urged to apply the patches promptly to reduce exposure to potential exploits.

IBM and Red Hat have fixed more than 400 previously unknown open source vulnerabilities, according to a report by SD Times. The disclosure highlights ongoing efforts by the companies to harden widely used open source software before flaws can be exploited. Patching this many undisclosed vulnerabilities at once underscores the scale of security maintenance behind enterprise Linux and open source platforms.

The OpenSSH project has released version 10.6, updating its widely used secure shell software for encrypted remote access. The release notes are published on the official OpenSSH site. Developers and system administrators are discussing the update, as OpenSSH runs on most servers and new releases typically bring security hardening and bug fixes that teams need to apply quickly.

A group of major banks is backing OSERA, a new effort to establish industry-wide standards and fixes for securing open source software. The initiative aims to coordinate remediation practices across the financial sector, where reliance on open source components carries significant security risk. Financial institutions have increasingly pushed for collective approaches to software supply chain vulnerabilities.

The OpenBSD project has released OpenSSH 10.6, the latest version of the widely used secure shell tool for encrypted remote login and file transfer. Announcement of the release spread quickly among system administrators, developers and security professionals, who track each OpenSSH update closely given how central the software is to internet infrastructure.

The OpenBSD project has released new LibreSSL versions 4.2.2 and 4.3.3, the open-source TLS library derived from OpenSSL. The announcement was shared on Undeadly, the OpenBSD community news site, and picked up by developers tracking cryptography and security software. Users of the portable edition are advised to update to receive the latest fixes.

Google is suspending part of its bug bounty program covering open source projects. The move means security researchers will temporarily no longer be rewarded for reporting certain vulnerabilities in Google's open source software. The announcement is drawing attention from the security community, with researchers questioning the implications for vulnerability disclosure and Google's commitment to open source security.

A long-time WordPress blogger says recurring security hiccups from hackers pushed them to move their site away from the platform, using the AI assistant Claude to help with the migration. The post also touches on automation, software development and community themes, and has drawn modest attention.

IBM and Red Hat have fixed roughly 400 previously unknown vulnerabilities in open-source software. The patch effort covers flaws that had not been publicly disclosed before, reducing the risk of exploitation in widely used open-source components. The companies' security teams identified and addressed the issues as part of ongoing upstream maintenance work.

A developer tool called PQC Triage lets users paste a software dependency manifest and see which cryptographic algorithms in their stack would fall first to a quantum computer. It is aimed at helping teams prioritise migration to post-quantum cryptography. Discussion is circulating in open-source and security communities as organisations assess quantum-era risks.

Microsoft will end support and security updates for Office 2021 on October 13, leaving users of the one-time-purchase suite without patches going forward. Coverage lays out five options for affected users, including migrating to Microsoft 365, moving to Office 2024, paying for Extended Security Updates, or switching to free alternatives like LibreOffice or web-based apps.

Ajit Varma, a senior figure at Mozilla's Firefox, has given an interview discussing how the browser approaches enterprise security, why organisations should be able to choose their own AI models, and the advantages open source software offers for building trustworthy products. The conversation centres on balancing privacy, flexibility and innovation for business users of the browser.

IBM and Red Hat, working with Lightwell, have patched more than 400 Java vulnerabilities, according to Cyber Magazine. The scale of the remediation effort is drawing attention across the software and security community, as enterprises running Java-based systems assess what the fixes mean for their own environments and patching priorities.

The Linux Foundation has released OpenChain Automotive SBOM Framework 1.0, a standardized framework for software bills of materials aimed at improving reliability and traceability in automotive software. The release gives carmakers and suppliers a common way to document the components in vehicle software, supporting compliance and supply chain transparency as software becomes central to modern vehicles.

Google has stopped accepting vulnerability reports for open-source software through its bug bounty program as of October 1. The company will temporarily no longer pay rewards for product flaws found in open-source projects, though reports on its own flagship products continue. The move is drawing attention in the security community, as the open-source incentive program was seen as an important way to support researchers auditing widely used projects.

Security firm Manifold Security published research asking whether AI models factor morality into their judgments about malicious code. The finding: when asked to assess whether code is malware, language models appear to bring moral reasoning into their analysis rather than relying purely on technical criteria. The report is circulating among developers and security researchers interested in how AI tools evaluate potentially harmful software.

Surveillance company Flock has been added to the CVE Program as a CVE Numbering Authority, meaning it can now assign official CVE identifiers to security vulnerabilities in its own Flock-branded hardware and software products. The designation, announced by the CVE Program, is drawing attention in the cybersecurity community given debate over Flock's surveillance footprint and how the company will handle disclosure of flaws in its own systems.

IBM's AI-powered vulnerability clearinghouse has identified hundreds of security flaws in Java software. The finding highlights the growing role of artificial intelligence in scanning open-source code for vulnerabilities at scale, giving developers advance warning of weaknesses that attackers could exploit. Security teams are expected to review the affected Java components.

Ed Siu of Wind RiverX discussed how defense technology can be scaled securely, speaking with DefenseScoop. The conversation centers on balancing rapid deployment of new capabilities with the strict security and compliance requirements of military systems, a growing challenge as defense agencies push to adopt commercial software practices faster.

A newly catalogued vulnerability, EUVD-2026-93874, has been assigned a CVSS score of 9.1 and affects Hewlett Packard Enterprise's AOS-Switch (AOS-S) software. The flaw involves buffer overflow issues in an affected interface, and successful exploitation could allow an unauthenticated remote attacker to compromise systems. Administrators running HPE network switches are being urged to review their exposure and apply patches or mitigations as they become available.

On the opening day of Pwn2Own Ireland 2026, security researchers reportedly exploited 32 zero-day vulnerabilities across targeted devices and software. The hacking contest, held in Ireland, pays researchers for demonstrating novel attacks against widely used systems. The high first-day tally is drawing attention in the cybersecurity community, with observers noting the scale of exploitable flaws still present in modern technology.

A discussion on spec-driven development (SDD), Harness deployment tooling, AI agents and security in multicloud environments is circulating among software engineering communities. The central question raised: your agent may be able to deploy code, but should it? The topic touches on AI-assisted programming, cloud architecture and the risks of granting autonomous agents production access.

IBM and Red Hat say they have remediated more than 400 previously unknown vulnerabilities in open source software. The disclosure highlights ongoing efforts by large enterprise vendors to identify and patch security flaws in widely used open source components. The companies' security teams reportedly uncovered and fixed the issues as part of routine vulnerability research and upstream contributions.

Debate is underway over who actually controls and profits from open source software, as major companies increasingly fund, contribute to and commercialize community-built projects. Commenters are weighing whether corporate backing undermines the open source model or secures its future, and whether maintainers get a fair share of the value they create.

Guidance is circulating on affordable cybersecurity fundamentals for small businesses, arguing that basic low-cost measures — such as strong passwords, multi-factor authentication, software updates and staff awareness — can prevent the majority of common attacks. Small firms are often targeted because they lack dedicated security teams, and owners are being encouraged to prioritise these simple defenses over expensive solutions.