TECHNOLOGY · AI · CYBERSECURITY · THE SYSTEMS SHAPING BUSINESSCoding assistants and the tools changing how software gets built.
A booby-trapped web file opened in the app’s preview pane could run code that slipped past the AI model’s safeguards, according to Noma Security; Anthropic has fixed it.
The update to software embedded in billions of devices also removes support for an old Windows file-sharing protocol, a change some users will have to plan around.
The new small model matches OpenAI's GPT-6 Luna on base price, adds effort levels from low to max and arrives with a 50% cut to Sonnet 5.5 cache reads.
About 1,500 people, mostly Meta employees in the U.S., are being notified because personal data had been stored in code repositories against company policy.
For about two years, converting an account into an organization quietly moved its access keys to a named owner, a gap that could have let attackers push images under trusted names.
Anyone who claimed a renamed or deleted GitHub repository’s old name could publish to some packages; GitHub has since added a 48-hour expiry, but owners must check their settings.
A crafted pattern in a pipeline file could let an attacker without an account take over the server that holds a company's source code and build secrets.
Push Security says the lure page showed Anthropic's real install command while its copy button swapped in one that runs an attacker's script.
The DevOps company is buying selected Augment assets rather than the whole startup, aiming to hand AI-written code straight to its own delivery agents.
The 9.8-rated flaw sits in the cache server's multiprocess mode, and the project's own Kubernetes example exposes it on every network interface.
The ModernBERT-based model judges a candidate secret in under 2 milliseconds and is in private preview, with general availability planned for later in October.
Announced at Team '26 Europe, the Agentic Multiplayer Protocol gives each agent an admin-assigned identity and scope, while Rovo Work takes on long, multi-step jobs.
The release also blocks shell characters in command-line usernames, hardens sftp downloads and promises faster releases as AI tools surface more bugs.
The Microsoft-owned platform is moving repository data into Azure Blob Storage and says internal tests show up to 35 times more write throughput.
GitHub rejected the report because a user must point the agent at untrusted content, but the researchers say the attack chain still works.
The companies used AI-assisted analysis to find the bugs and now let enterprises queue specific open-source dependencies for embargoed fixes and backports.
Checkmarx says one package, function-flag, has been delivering malware for more than a year and drew about 37,000 downloads with no advisory flagging it.
CVE-2026-21589 lets attackers without a login read files in the web root of self-hosted Jira, Confluence and Bitbucket, and Atlassian says exposed servers should come offline until patched.
The firm that made an early bet on Anthropic joined the AI coding startup's $5 billion round, a public show of support after last week's fight over a board adviser.
The count reflects both a surge in machine-found bugs and the kernel team's policy of tagging nearly every stable fix with a CVE, not 1,313 serious holes.
The company paused its open-source rewards program Oct. 1 after maintainers were flooded with AI-generated findings that did not hold up.
The Postgres company is betting that coding agents will need vast numbers of small, instantly created databases, and it is adding a SQLite-based engine to supply them.
A crafted flow configuration could break out of the prompt template sandbox and run commands on a server that holds JWT signing keys.