Topic

#Security

166 articles on Security — news, releases, guides and analysis from the SourceFeed engine.

Article 8h ago 1

Domas Turns DRAM Scrambling Into a Skeleton Key

A single register poke rewires physical addresses so every fence built above the memory controller quietly falls apart.

Lenn Voss

Grok Build's Full-Repo Upload Broke Local-First Trust

Wire captures show the CLI shipped entire git bundles to GCS, and the privacy toggle never controlled it.

Article · 1mo ago5

Grok Build Uploads Your Whole Repo by Default

A wire-level capture of the official CLI gives teams a concrete privacy baseline before they point it at real code.

Article · 1mo ago0

Lock Down a Web App with CSP, SRI, and Security Headers

Ship an Express app with a strict Content-Security-Policy, subresource integrity checks, and a full set of hardened HTTP headers, then grade your work with a real online scanner.

Tutorial · 1mo ago0

Claude Code’s Silent Permission Click on Windows

A reported TUI focus bug can approve or reject tool prompts you never read. Audit now.

Article · 1mo ago0

Autonomous Pentesting: Inside the Multi-Agent Architecture of PentAGI

How the open-source security tool orchestrates LLMs and sandboxed Kali Linux environments to automate offensive workflows.

Article · 1mo ago0

Java 27: The Under-the-Hood Efficiency Release

With compact headers and G1 everywhere, Java 27 prioritizes deployment density and out-of-the-box performance over language syntax churn.

Article · 1mo ago0

Why AI Editors Keep Generating Prototype Pollution Vulnerabilities

Recursive merge helpers generated by AI tools frequently lack basic security guards, exposing JavaScript applications to prototype pollution.

Article · 1mo ago0

GPT-5.6 and the Shift to Agentic Runtimes

OpenAI's latest model family and desktop consolidation signal a transition from passive code generation to active, autonomous execution.

Article · 1mo ago0

Why You Need a Vulnerability Harness, Not a Security Agent

Stop pointing raw LLMs at your codebase. Build a stateful, model-agnostic pipeline to find and validate real security bugs.

Article · 1mo ago0

Issue Short-Lived SSH Certificates with HashiCorp Vault (No More Static Keys)

Set up Vault's SSH secrets engine as a certificate authority so developers get auto-expiring SSH certs instead of long-lived keys sitting in authorized_keys files.

Tutorial · 1mo ago0

GitLost Proves Agentic Workflows Have No Trust Boundary

A single public GitHub issue tricked an AI agent into pasting private repo contents into a comment anyone could read.

News · 1mo ago1

When AI Audits Cryptography: Inside the CIRCL Bug Hunt

AI agents found seven real vulnerabilities in Cloudflare's cryptographic library, exposing the gap between automated reasoning and real-world exploitability.

Article · 1mo ago3

Securing GitHub Agentic Workflows Against the GitLost Exploit

The GitLost vulnerability exposes private repositories through public issues, proving that English-programmed agents require strict, traditional security boundaries.

Article · 1mo ago0

A 19-Year-Old Linux Kernel Zero-Day Discovered via kernelCTF

A type confusion bug in the network bonding driver exposes the persistence of silent, long-lived kernel vulnerabilities.

Article · 1mo ago0

Hardening the Pipe: Why OpenSSH 10.4 is a Mandatory Upgrade

Stricter transport protocol enforcement, fatal sandbox failures, and experimental post-quantum signatures make OpenSSH 10.4 a critical upgrade.

Release · 1mo ago0