4 articles
AI is rapidly accelerating vulnerability discovery, forcing AppSec teams to adapt by integrating AI into threat modeling, code review, and developer workflows to keep pace.
A hacker exploited a vulnerability in the AI coding tool Cline, using a prompt injection to trick it into installing the OpenClaw AI agent on users' computers. This stunt highlights the serious security risks of autonomous AI agents.
The Linux kernel CNA team reviews stable kernel bug fixes to assign CVEs based on cve.org's vulnerability definition. They focus on commits that fix exploitable issues, like certain WARN_ON triggers, ignoring non-security bug fixes. The process involves team voting and community input, issuing about 60 CVEs weekly. Users are advised to apply all stable updates rather than cherry-picking fixes.
Notepad++ v8.9.2 enhances security, making its update process "effectively unexploitable." This follows a state-sponsored hack, with new signature verification and auto-updater hardening.