New research reveals that DeepSeek-R1 produces more security vulnerabilities in code generated from prompts containing politically sensitive topics for China, such as Tibet or Uyghurs.
An article about theHarvester, a Linux tool that maps your online footprint by gathering public data from search engines and repositories, revealing exposed emails, subdomains, and more.
HiR Information Report - Personal page of ax0n, featuring projects, blog entries, social media links, and professional background in cybersecurity and technology.
An opinion piece detailing how the EU's Cyber Resilience Act will impact open source developers, with a focus on the distinctions between commercial and non-commercial developers and the potential benefits for the open source community.
The first-ever malicious Model-Context-Prompt (MCP) server, a trojanized npm package named `postmark-mcp`, has been discovered exfiltrating sensitive data from users’ emails. The package copied every email processed to a server controlled by the attacker.
Replays of the .conf25 Global Broadcast sessions, including the Welcome Keynote, Product Keynote, and various sessions covering topics like AI, security, observability, and Splunk platform updates.
Fly.io provides a secure and fast platform for deploying AI workflows and LLM-generated code using ephemeral, kernel-isolated virtual machines (Fly Machines). It offers features like secure sandboxing, fast startup times, a clean slate for each run, a simple API, and support for whole applications, not just code snippets.
This week's security roundup covers the Anubis web AI firewall, AI exploit generation, a vulnerability in CodeRabbit, the potential illegality of adblocking in Germany, a Microsoft Copilot audit log issue, and a disputed Elastic EDR vulnerability.
Trail of Bits announces the open-sourcing of Buttercup, their AI-driven Cyber Reasoning System (CRS) developed for DARPA’s AI Cyber Challenge (AIxCC). The article details how Buttercup works, including its four main components (Orchestration/UI, Vulnerability discovery, Contextual analysis, and Patch generation), provides instructions for getting started, and outlines future development plans.
This article details significant security vulnerabilities found in the Model Context Protocol (MCP) ecosystem, a standardized interface for AI agents. It outlines six critical attack vectors – OAuth vulnerabilities, command injection, unrestricted network access, file system exposure, tool poisoning, and secret exposure – and explains how Docker MCP Toolkit provides enterprise-grade protection against these threats.
