⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Since its launch in 2016, OSS-Fuzz has contributed significantly to making open-source secure by finding and reporting tens of thousands of bugs.
This article argues that better security starts with asking the right questions, not just collecting more data. It emphasizes that security is an enabler of innovation, especially in the age of AI, and must consider the interconnectedness of people, processes, and technology.
Google's OSS-Fuzz project expands to automatically generate patches for discovered vulnerabilities, easing the workload on open-source maintainers by providing ready fixes.
This article discusses how OSS-Fuzz, launched in 2016, has significantly enhanced open-source security by finding and reporting tens of thousands of bugs. It highlights the shift from merely finding vulnerabilities to reducing maintainer burden through automated patches.
A critical vulnerability (CVE-2026-59726, CVSS 10.0) in Ruflo, an open-source AI orchestration platform, allows unauthenticated attackers to execute remote commands and manipulate AI memory. The flaw, dubbed RufRoot, affects all versions before 3.16.3 and stems from an exposed Model Context Protocol (MCP) bridge that grants access to 233 tools, including shell commands and memory storage, without authentication.
A maximum-severity vulnerability (CVE-2026-59726, CVSS 10.0) was discovered in Ruflo, an open-source agent meta-harness for Claude Code and Codex. The flaw, named RufRoot, exposes 233 tools including shell command execution, database operations, agent management, and memory storage through an unauthenticated MCP bridge bound to 0.0.0.0 by default.