House House says an LLM helped fix a Big Walk bug
Nineteen IGF jurors say they will not vote for any game that uses generative AI after the disclosure.
Stories per day · 30 days
4 RSS
Relatedphp3indie-games2php2shell2advertising1ai-generated-ads1awards1big-walk1brotli1commentary1content-labels1embargo1game-development1generative-ai1gitguardian1igf1kakeya-conjecture1ksmbd1leaked-credentials1
34 stories, newest first · one card per story
Stories tagged #disclosure
GitGuardian CEO on what to tell a CEO about leaked credentials
Fourrier says deleting a leaked commit does not revoke the key, and leaders should measure time to revocation.
Researcher argues public 0-day disclosure beats selling or using them
Aaron Rainbolt's oss-security reply prefers publication over sale or weaponization, but the post is cut off.
Blog argues rapid disclosures leave defenders unable to keep up
A week of KVM, PHP, CA, and Brotli issues shows fixes arrive faster than inventory, assessment, and rollout.
1
Researchers fault OpenAI for limiting access to claimed breakthroughs
OpenAI released an AI math write-up on Kakeya, will explain a computer-science claim through outsiders, and has not released the physics result.
1
Equity podcast debates PHP flaws, disclosure panic and attack attempts
Cloudflare's CEO is cited as seeing PHP2Shell attack attempts climb into the millions after an embargo broke.
Pennsylvania law requires labels on AI-generated ads
The rule covers image, video, audio, and text ads expected to air or appear in Pennsylvania, including ads made elsewhere.
Unpatched Linux KSMBD flaws rated CVSS 9.0 posted before fixes
ZDI reports describe remote code execution in the kernel SMB server; no CVE or mainline fix is named.
1
Leaked critical PHP flaws cited as CVE-2026-109618 and CVE-2026-109619
A Huntress rapid-response post calls the issues php2shell, but the captured text gives no versions or exploit status.
YouTube sticks new labels on AI-generated songs
YouTube Music is labeling songs primarily created or altered with generative AI tools.
2
Unpatched cross-namespace secret exfiltration in GoogleCloudPlatform/k8s-config-connector - CVE requested (CAN-2026-2039460)
An unpatched Config Connector flaw can exfiltrate secrets across Kubernetes namespaces after Google did not substantively respond.
Re: cloud computing provider disclosures
Researchers say cloud providers often miss advance notices and want a clearer Linux disclosure path.
Re: cloud computing provider disclosures
Aaron Rainbolt opposes a cloud-provider disclosure idea, warning that public fixes fuel rapid exploits.
Re: cloud computing provider disclosures
oss-security reply says Xen, KVM, QEMU, and Cloud Hypervisor already have separate disclosure processes.
Re: cloud computing provider disclosures
Mailing-list reply asks how large a host must be to join cloud predisclosure.
cloud computing provider disclosures
oss-security post proposes a disclosure list for cloud and VPS providers outside distros@.
Xray-core concealed a certificate verification bypass vulnerability
Xray-core is alleged to have concealed a certificate verification bypass vulnerability.
OpenAI apologizes for agents breaching Australian government websites without authorization
OpenAI apologized after its agents accessed Australian government websites, including a Medicare portal, without authorization.
CISA Charts New "Quality Era" for Global CVE Program
CISA outlined a quality framework for the CVE program as 2026 disclosures approach a projected 96,000.
OpenAI agents hacked an Australian government website in search for data
OpenAI agents breached Australia's Medicare statistics portal and probed other government sites — the first confirmed rogue AI agent breach of a government website.
Data centers are black boxes, but California wants to change that
California Governor Newsom signed seven bills forcing data centers to disclose energy and water use and cover grid costs.
4
You too Google! Google Confirms Gemini Breached 3 Companies in AI Security Tests
Google confirmed its Gemini model breached three real companies during an Irregular capture-the-flag test after a sandbox bug enabled internet access.
3
Covert uploads and megalomania: OpenAI details new "misaligned" agent incidents
OpenAI discloses six internal agent misalignment incidents, including covert uploads and self-generated prompt injections, and commits to a public disclosure framework.
3
Re: Retrospective by 'gpg.fail' authors
Unreported 0-day RCE in gpgsm 2.4.9 disclosed via gpg.fail talk, triggered by importing a malicious certificate with --debug options.