Search: “Software Technology Parks of India (STPI)”

31 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll

SeverityAll critical 0 high 0 medium 0 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

India’s STPI serves TerminalFix-style attack via fake Cloudflare check

India's STPI government website serves a spoofed Cloudflare verification page that preloads malicious commands into visitors' clipboards for execution in Windows Terminal, matching TerminalFix-style attacks.

A malicious external JavaScript on the ananta.stpi[.]in subdomain of India's Software Technology Parks of India displays a fake Cloudflare 'Verify you are human' prompt and silently writes a URL into the visitor's clipboard, instructing the user to paste and execute it in Windows Terminal. Researcher Vibhum Dubey reported the behavior to STPI and CERT-In; the script loads from the recently registered cdn[.]quickdelivr[.]com and assigns each visitor a unique session identifier. The malicious script remained embedded after the overlay briefly disappeared, and the destination URL was flagged as malicious by 17 VirusTotal engines. No attribution has been established, though the pattern matches Microsoft's TerminalFix, a variant of ClickFix.

CSO OnlineSep 11, 15:26 UTC · 5d agoPhishing & fraud in the wild1

An Empirical Security Analysis of Open-Source Software Used in Onboard Satellite Systems

Study of 126 onboard satellite OSS repositories finds 2,827 security findings, 72% medium severity or higher, dominated by memory safety and code quality weaknesses.

Researchers performed an empirical security analysis of 126 public repositories of open-source software used in onboard satellite systems using SBOM generation, software composition analysis, static application security testing, infrastructure-as-code analysis, and secret scanning. After cleaning and deduplication the pipeline produced 2,827 findings, with medium-severity findings accounting for 49% and 72% classified medium or higher. A CWE-based taxonomy mapped all findings to eight weakness families, with Memory Safety and Code Quality dominating, followed by Input Validation and Injection. Project-developed code accounted for 81.4% of findings, though external dependency code remained relevant; findings do not establish mission-specific exploitability.

arXiv cs.CRSep 14, 11:54 UTC · 3d agoResearch1

MaxKernel: Agentic Kernel Generation for TPUs

Researchers open-source MaxKernel, a multi-agent LLM system that generates and optimizes TPU kernels matching expert hand-tuned baselines on JaxBench.

MaxKernel is a multi-agent system offering three paradigms for TPU kernel development: human-in-the-loop collaborative design, a fully autonomous metric/trace-driven optimization loop, and graph-based autonomous search for global exploration. All paradigms draw on a shared pool of specialized sub-agents for planning, implementation, self-debugging, testing, and hardware profiling. Evaluated on JaxBench's 50 diverse TPU kernel tasks and real-world workloads from open-source models, it consistently matches expert hand-tuned baselines. The system is open-sourced via the AI-Hypercomputer GitHub repository.

Hugging Face daily papersSep 2, 20:00 UTC · 14d agoAI tools & infra1

A Security Risk Assessment Framework for AI-Powered Development Tools

Researchers propose SRF, a framework showing AI-generated code from multiple development tools introduces vulnerabilities, worst in input and file handling tasks.

The paper presents the Security Risk Assessment Framework (SRF), combining threat modeling, security analysis, and quantitative risk evaluation based on vulnerability criticality for AI-generated code. Code generated by multiple AI-powered development tools was analyzed with Bandit and Semgrep across security-relevant programming tasks. All evaluated tools introduced vulnerabilities; risk varied mainly by task type, with input processing and file handling showing higher risk, while differences between tools were smaller than differences across task categories.

arXiv cs.CRSep 16, 13:36 UTC · 23h agoAI safety & security

Major Cyber Threat Detection Vendors Shift from MITRE to UK Testing Program

SE Labs launched PIVOT, a six-month vendor detection testing program backed by CrowdStrike, Fortinet, Palo Alto Networks and Sophos, as major vendors exit MITRE evaluations.

SE Labs unveiled PIVOT on September 15, a six-month testing program in which its ethical hackers replicate nation-state and criminal attack chains against participating vendor products, with results due January 2027. Broadcom (Symantec/Carbon Black), CrowdStrike, Fortinet, Palo Alto Networks and Sophos have confirmed participation, and Gartner and Forrester analysts will verify the underlying evidence before publication. The launch follows declining participation in MITRE Engenuity ATT&CK Evaluations: Enterprise, which fell from 30 vendors in 2023 to 11 in 2025 after public withdrawals by Microsoft, SentinelOne and Palo Alto Networks.

Infosecurity Magazineupdated 08:33 UTC · 4h agofirst Sep 16, 09:00 UTC · 1d agoIndustry 12 sources

PRs NOT Welcome: How Top AI Open Source Projects Are Managing Thousands of Contributors

Top AI open source projects like Vercel, Astro, Flue, and tldraw are restricting external PRs and using agent-based software factories to triage, fix, and review contributions.

Several prominent AI-native open source projects are closing or limiting external pull requests, largely because submissions are often AI-generated. Vercel built a multi-agent software factory for its AI SDK (over 20 million weekly npm downloads) that now authors 25-35% of merged PRs and closes 70-80% of issues. Astro adopted similar auto-triage automation, Fred Schott created the Flue framework with automatic PR-to-issue conversion, and tldraw automatically closes external PRs.

Latent SpaceSep 1, 16:17 UTC · 15d agoAI industry

How to Keep Malware’s Rotating Infrastructure From Becoming a Detection Gap

ANY.RUN marketing piece argues SOC detection lags rotating malware and phishing infrastructure, citing a 46-country campaign and 3DBlast kit to promote TI feeds.

ANY.RUN describes how malware and phishing campaigns rotate domains and hosting, making single-IOC blocking ineffective for SOC teams. One investigated phishing campaign spanned 46 countries with 425 kit URLs across 240 hosts, 94% of which were seen for only a single day. A phishing kit dubbed 3DBlast impersonates Microsoft 365 and Google using BitB, AiTM, OAuth device-code phishing and DOM relay techniques. The article is primarily a promotion for ANY.RUN TI Feeds and TI Lookup products.

Cyber Security NewsSep 15, 15:36 UTC · 1d agoIndustry

A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK

Trace2ATT&CK maps eBPF kernel telemetry to MITRE ATT&CK via provenance graphs and RAG with local open-weights LLMs, validated on 347 Atomic Red Team tests.

Trace2ATT&CK collects kernel-level events via eBPF, correlates attacker commands into a provenance graph, and derives compact graph representations suitable for LLM-based reasoning, mapping behavior to MITRE ATT&CK techniques with ranked candidates and rationales. Mapping uses both pure LLM prompting and retrieval-augmented generation grounded in the ATT&CK knowledge base. It was evaluated on 347 Linux Atomic Red Team tests using locally deployed open-weights LLMs. RAG consistently improved ATT&CK mapping over pure prompting, and provenance graphs substantially outperformed raw telemetry, without compromising data confidentiality.

arXiv cs.CRSep 11, 13:35 UTC · 5d agoResearch

The OCUDU dApp Platform: An Open Runtime and E3 Interface for Real-Time AI-RAN

OCUDU open runtime lets third-party signed AI-RAN dApps run inside production 5G distributed units under three timing contracts, released as BSD-3 preview.

The OCUDU dApp platform provides an open runtime and E3 interface for executing signed AI-RAN applications inside a production 3GPP NR distributed unit, where prior dApp frameworks could only observe export streams. Modules run under three typed timing contracts: GPU receive-chain residency (Class A), the scheduler's 100 microsecond deadline (Class B), or non-blocking observer (Class C). On a GB10 gNB, dApps including an out-of-tree neural equalizer ran on a live cell without fallback. Platform, SDK, and a zero-hardware quickstart are public under BSD-3-Clause-Clear as a preview of the OCUDU AI-RAN Working Group 2.

arXiv cs.AI / cs.LG / cs.CLSep 7, 18:03 UTC · 9d agoAI tools & infra1

Quantifying IIoT Sensor Node Criticality by Fusing its Data Criticality and Security Vulnerability

Researchers propose a Dempster–Shafer framework fusing IIoT sensor data criticality with CVSS 4.0/3.1 vulnerability scores to rank node criticality.

The paper introduces a framework that evaluates Industrial IoT sensor node criticality by fusing data criticality and cybersecurity vulnerability scores using Dempster–Shafer (D-S) theory. It was validated on a dataset from red wine production and is claimed to generalize to other industrial settings with minimal modification. Results show criticality rankings derived from CVSS 4.0 scores differ significantly from those derived from CVSS 3.1, underscoring how vulnerability scoring methodology affects security prioritization.

arXiv cs.CRSep 9, 07:03 UTC · 8d agoResearch

BugBase Pentest Copilot Enterprise automates black-box pentesting

BugBase launched Pentest Copilot Enterprise, an autonomous AI black-box pentesting platform using parallel agents to attack 100 vulnerability classes with validated PoCs.

BugBase announced Pentest Copilot Enterprise, which performs black-box red teaming without source-code access while maintaining authenticated context. Parallel specialized agents map pages, APIs, accounts and business functions, then execute iterative attacks across 100 vulnerability types including authentication, injection and business-logic flaws. The tool uses real Chromium browsers to preserve cookies, tokens, CSRF state and multiple identities, and navigates WAFs, bot detection, CAPTCHA and T-OTP. BugBase claims full scope coverage on OWASP Juice Shop, Broken Crystals and GOAD, NHA, and DRACARYS Active Directory labs.

Help Net SecuritySep 4, 12:28 UTC · 13d agoTools

StochBench: A Domain-Specific Benchmark for Stochastic Processes in Lean

StochBench introduces 450 graduate-level stochastic-processes problems in Lean 4; an Opus 4.8-based agent proved 34.9% under a 15-minute limit.

StochBench is a Lean 4 benchmark of 450 graduate stochastic-processes problems, each paired with its natural-language source, covering Markov chains, renewal processes, martingales, Brownian motion, stochastic calculus, weak convergence, and Poisson and continuous-time Markov processes. The benchmark addresses field-specific applied mathematics underrepresented in Mathlib, unlike competition-math-dominated suites such as IMO and Putnam collections. An Opus 4.8-based agent achieved a 34.9% proof rate (157/450) under a 15-minute per-problem limit, showing the benchmark remains challenging for advanced provers.

Hugging Face daily papersSep 7, 20:00 UTC · 9d agoAI research

What 50 open source projects taught us about security in the AI era

GitHub's Secure Open Source Fund Session 4 improved security across 50 open source projects using AI-assisted workflows, tooling, and funding.

GitHub reported outcomes from Session 4 of its Secure Open Source Fund, which covered 50 open source projects. Participating maintainers combined AI-assisted workflows, GitHub security tools, expert guidance, and direct funding to improve project security. The post frames lessons about securing open source maintenance in the AI era; no specific vulnerabilities or incidents are named in the announcement.

GitHub Blog · SecurityAug 13, 16:00 UTC · Aug 13, 2026Industry1

Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain

Unit 42 warns attackers increasingly target CI/CD pipelines and developer tools rather than application code, urging full SDLC supply chain visibility.

Palo Alto Networks Unit 42 research argues attackers are shifting focus from application code to overlooked corners of the software development lifecycle supply chain, including CI/CD pipelines and developer tooling. The write-up calls for total SDLC visibility and strict security controls to defend these developer-facing attack surfaces.

Palo Alto Unit 42Aug 21, 23:00 UTC · 26d agoResearch in the wild1

NVIDIA Open-Sources OSMO: One YAML Orchestrates Physical AI Training, Simulation, and Robot Testing

NVIDIA open-sourced OSMO, a Kubernetes-native YAML orchestrator running physical-AI training, simulation, and robot testing across mixed GPU tiers.

OSMO (Apache-2.0, latest release 6.3.1) lets teams describe training, simulation, and hardware-in-the-loop pipelines in a single YAML and routes tasks across datacenter GPUs (GB200), workstation RTX hardware, and edge devices like Jetson AGX Thor. It ships Helm charts and containers on NGC, uses the KAI Scheduler with NVLink topology-aware placement, and includes RBAC, OAuth2, and TLS termination. NVIDIA says it is battle-tested on GR00T, Isaac Lab, Isaac Sim, and Isaac ROS, and integrates with Claude Code, OpenAI Codex, and Cursor agents.

MarkTechPostSep 14, 08:04 UTC · 3d agoAI tools & infra

JarvisGUI: Towards Cross-Device GUI Agents with Dynamic Task Composition

JarvisGUI benchmark tests GUI agents on cross-device workflows across Android, Windows, and Ubuntu, revealing major gaps in state transfer and long-horizon reasoning.

JarvisGUI is a dynamic benchmark that formulates GUI tasks as input-output transformations under a lightweight type system, automatically composing multi-step cross-device workflows across Android, Windows, and Ubuntu virtual environments. Evaluation shows state-of-the-art open-source GUI agents struggle with state-transfer awareness, cross-platform contextual reasoning, and long-horizon dependency management, exposing a capability gap invisible to existing single-device benchmarks.

arXiv cs.AI / cs.LG / cs.CLSep 9, 16:59 UTC · 7d agoAI research1

TPMSpy: Validation of Measured Boot Systems by Low-Level Tracing of TPM Usage

Researchers present TPMSpy, a platform-agnostic method validating TPM Measured Boot via low-level tracing, finding inconsistent Linux systemd measurements that break remote attestation and LUKS decryption.

An arXiv paper (2609.05011) introduces TPMSpy, a method that analyzes virtualized system–TPM interactions to independently reconstruct and validate TPM Event Logs without relying on the quoting mechanism, applicable to open and closed systems and demonstrated on Linux and Windows. A longitudinal analysis of Linux systems running systemd versions 245–258 (2020–2025) found wide divergence in Measured Boot usage, undocumented behavioral changes, and no common usage pattern. The authors report inconsistent measurement of user-space systemd services, which prevents reliable remote attestation and LUKS disk decryption on affected systems.

arXiv cs.CRSep 4, 11:23 UTC · 13d agoResearch

Evaluating Context Segmentation in Locally Deployable SLMs for Cybersecurity CTF Tasks

Context segmentation framework boosts memory-constrained gemma-4 agents on picoCTF, solving 18.52% of tasks standard execution fails, highlighting local SLM offensive risk.

The paper introduces context segmentation, a two-level agentic framework that divides long-horizon CTF exploitation tasks into contextually isolated sub-problems to counter context bloat and cognitive degradation from accumulated tool-call outputs. It evaluates memory-constrained gemma-4 models on the picoCTF dataset; the E4B model achieves competitive rewards with superior token efficiency compared to brute-force retries. It solves 18.52% of tasks that standard agentic execution fails to complete. The work frames locally deployed open-weight SLMs as an escalating risk since they bypass proprietary API guardrails; code is released on GitHub.

arXiv cs.CRSep 11, 13:34 UTC · 5d agoAI safety & security1

Measuring the Security of the Evolving Software Supply Chain: a Research Agenda

Researchers propose a unified cross-ecosystem measurement agenda for software supply chain security, targeting dependency modeling and AI-generated dependency patterns.

The paper argues that existing quantitative measurement and vulnerability management approaches for software supply chain security are fragmented and ecosystem-specific, limiting comparable risk assessments. It lays out a research agenda starting with a Systematization of Knowledge to expose gaps in dependency modeling, transitive dependency treatment, and real-world exploitability of vulnerabilities. It further warns that AI-assisted development with coding LLMs will create dependency patterns not captured by traditional Software Composition Analysis tools, motivating a rethink of dependency modeling.

arXiv cs.CRSep 8, 14:37 UTC · 8d agoResearch

The Rise of the Forward Deployed Engineer — and How To Do the Job Right

Palantir veteran Vinoo Ganesh traces the forward deployed engineer role and shares practices for building effective FDE teams.

Kepler CEO and former Palantir forward deployed engineer Vinoo Ganesh argues that labs, startups, and PE firms hire FDEs without a shared definition of the role. He recounts Palantir's Project Frontline rotation, which trained about 250 software engineers as FDEs, many now leading forward deployed teams at OpenAI, Anthropic, xAI, and Anduril. A 2013 failure of the Phoenix transaction store at a bank, where real-world data gaps caused roughly 2.3 million keyspaces and an out-of-memory crash, illustrates why FDEs must own the gap between design and production reality. At Kepler he places the FDE function inside product rather than sales.

Latent SpaceSep 12, 15:01 UTC · 4d agoAI industry 4 sources1

CertiFlash: A Formal Verification Framework for Flash Translation Layers in Computational Solid State Drives

CertiFlash provides machine-checked formal verification of SSD flash translation layers, proving isolation, integrity, and ownership invariants to prevent tenant data leaks.

CertiFlash is an open-source formal verification framework for Flash Translation Layers (FTL) in computational SSDs, mechanized in the Rocq proof assistant. It shows that a faulty FTL can corrupt device state at five surfaces (e.g., leaking data between tenants or dropping integrity tags), demonstrated on a DaisyPlus OpenSSD. Designers prove once that every operation of a general FTL model preserves a global invariant covering mapping, isolation, integrity, ownership, and allocation; new designs need only discharge five hypotheses. Across four case studies, added effort was 27-3,231 lines against a 16,489-line framework.

arXiv cs.CRSep 9, 15:44 UTC · 7d agoResearch1

ProgramDistill: From Interactive Web Apps to Verifiable Reference-Guided SWE Tasks

ProgramDistill is a benchmark evaluating coding agents on reconstructing web app features from reference applications, testing nine frontier agents.

ProgramDistill evaluates coding agents on features discovered through interaction with fully functional reference applications, factorizing apps into features with replayable behaviors verified via gold patches. Its mine-craft-patch pipeline discovered 1,975 replay-verified behaviors across 26 applications and built 4,063 tasks without human intervention. On cumulative full-application reconstruction workflows, GPT-6 Astra achieved 49.2% and Claude Opus 5 28.8% success. In partial reconstruction, success drops from 100% to 64.0% and from 96% to 32% as restoration depth increases from 1 to 8.

Hugging Face daily papersSep 15, 20:00 UTC · 1d agoAI research

IdeaAMBIG: Benchmarking Implementation-Critical Gaps in Research-Idea Specifications

IdeaAMBIG benchmark of 660 specification-gap instances shows LLMs localize implementation-critical research gaps poorly, with best model at 9.6% defect recovery.

IdeaAMBIG is a benchmark of 660 evidence-grounded instances evaluating whether research-method specifications provide enough information for faithful implementation: 163 real-world gaps from reproducibility reports and GitHub issues plus 497 controlled synthetic gaps. It tests codification-readiness assessment, defect localization, and clarification action generation across 13 LLMs. The best model achieves only a 9.6% Macro Defect Recovery Rate on real-world instances, though 80.6% clarification success when given the annotated defect, and an oracle study shows gold resolutions raise codification-ready rates from 14% to 98%. Defect localization emerges as the main bottleneck across all evaluated models.

Hugging Face daily papersSep 8, 20:00 UTC · 8d agoAI research

OPEN-1B: A Fully Auditable Training Run

Open-1B releases a 1B-parameter model with bitwise-reproducible training, letting independent auditors verify every step of the run on commodity hardware.

The paper introduces a 'fully auditable' tier of model transparency: every training operation is reproducible with bitwise certainty on heterogeneous commodity hardware by imposing definite ordering on GPU kernel reductions, data batch ordering, and collective communication. Because replaying a full run on one machine is infeasible, a collective verification scheme lets many independent auditors certify individual steps covering the whole run. The authors release Open-1B with its full pretraining dataset, every intermediate checkpoint, the training codebase, and an audit harness. This rules out undisclosed data, injected biases, or backdoors that proof-of-learning or proof-of-training-data techniques cannot exclude.

arXiv cs.AI / cs.LG / cs.CLSep 15, 16:23 UTC · 1d agoAI research

AI made software development unrecognizable. Is cybersecurity next?

Opinion piece argues AI-driven shifts that transformed software development—agent-run SOCs, autonomous triage—will soon reshape cybersecurity operations and staffing.

A CSO Online analysis notes Google Cloud research found 90% of developers already use AI, while a March 2026 Federal Reserve paper found coder employment growth fell roughly 3% since ChatGPT's arrival. Gartner predicts 80% of organizations will run smaller, AI-augmented engineering teams by 2030. Security leaders from Contrast Security, Menlo Security and the Cloud Security Alliance expect agent-run SOCs, machine-speed containment and abundant vulnerability discovery, but caution that absorption capacity and autonomous production-environment validation remain bottlenecks.

CSO OnlineSep 16, 08:25 UTC · 1d agoIndustry

Introducing GPT-6 Astra for developers

OpenAI introduces GPT-6 Astra for developers, with improved attention to detail, prompt understanding, and notably strong 3D model generation.

Simon Willison shares early hands-on impressions of OpenAI's GPT-6 Astra developer release, noting across-the-board improvements in attention to detail and prompt understanding. The model reportedly excels at building 3D models, producing renderings of gardens, shipyards, animals, cityscapes, and Dyson spheres. The write-up is third-party testing rather than an official announcement.

Simon WillisonSep 5, 23:27 UTC · 11d agoModel release1

The 12 Best Managed XDR Services, Compared and Priced

A comparison of twelve managed XDR providers covering pricing models, telemetry breadth, and distinguishing genuine MXDR from rebranded MDR services.

The article compares twelve managed XDR providers including Bitdefender, CrowdStrike, Palo Alto Unit 42, Trend Micro, Fortinet, Secureworks Taegis, Stellar Cyber, Ontinue, and ReliaQuest, highlighting pricing models and telemetry breadth. It explains that genuine MXDR must actively monitor identity, cloud, and email telemetry rather than merely ingest it, and typically costs 30-60% more than endpoint-only MDR. It also notes Sophos completed its approximately $859 million acquisition of Secureworks in February 2025.

GBHackersSep 9, 08:07 UTC · 8d agoIndustry 3 sources2

DataFlex-RL: An Evaluation Platform for RLVR Data Policies

DataFlex-RL benchmark of 13 RLVR data policies on Qwen2.5-7B finds none reproducibly beats uniform sampling under matched GRPO training.

DataFlex-RL is an evaluation platform comparing rollout-selection, reweighting, and mixture data policies for RLVR under a common GRPO recipe. Across 13 configurations and 12 matched seeds with Qwen2.5-7B-Base on 12 math, logic, and science benchmarks, uniform GRPO improved domain-balanced accuracy by 7.76 points, but no alternative policy achieved a statistically significant improvement. A corrected 12-seed Llama-3.1-8B-Base extension found no consistent winner, and math-heavy evaluation summaries were negatively correlated (-0.33) with domain-balanced summaries.

Hugging Face daily papersSep 4, 20:00 UTC · 12d agoAI research

AI is adding to the review load on open-source projects, many of them thinly funded

ACM Technology Policy Council authors warn AI-generated code is overwhelming thinly funded open-source maintainers, raising software supply chain security risks.

Six authors including Simson Garfinkel and Josiah Dykstra, writing for the ACM Technology Policy Council, argue AI coding tools flood open-source projects with contributions that human maintainers must still review. They cite Google's CodeMender agent contributing 72 security fixes to open-source projects, some as large as 4.5 million lines of code, between April and October 2025. Funding is lopsided: the Linux Foundation raised $292,217,236 in 2024 versus $2,379,402 for the Apache Software Foundation. They also note most open-source applications still ship no SBOM despite US and EU mandates, and attackers increasingly plant malicious packages in popular repositories.

Help Net Security04:30 UTC · 8h agoAI industry1