VulnCheck says Glasswing fixed 217 of nearly 38,000 claimed flaws
Of 5,276 validated ledger entries, Garrity says 217 are fixed, and he disputes Anthropic's 94.2% true-positive rate.
Stories per day · 30 days
3 RSS
Relatedopen-source5oss-security5curl4mailing-list4hackerone3ai-reports2bug-bounty2cna2coordinated-disclosure2cve2ai1ai-generated-reports1alpr1anthropic1apache1apache-camel1bugcrowd1crowdsourced-security1
55 stories, newest first · one card per story
Stories tagged #vulnerability-disclosure
Curl adopts public disclosure for low and medium vulnerabilities
Open source projects should follow Curl's example and report low and medium severity issues publicly to reduce volunteer workload.
OpenAI says AI bug reports are overwhelming open-source maintainers
Daybreak has developed 661 tested patches, of which maintainers accepted 458, and OpenAI urges quality and coordinated disclosure.
FedTrust-CVDv2 ties vulnerability evidence to approved disclosure actions
A reference implementation accepted all 25 valid fixtures and rejected all 650 invalid fixtures.
Microsoft ties bug bounty rewards to Complete versus Not Complete reports
Reports filed on or after October 20, 2026, at 8 AM Pacific need a PoC and exploitability details to count as Complete.
5
curl will handle low and medium vulnerability reports in public
From October 26, 2026, only high and critical reports stay private on HackerOne; over 90% of recent submissions were below high.
Curl moves low and medium vulnerability reports public on October 26
High and critical reports stay private; Stenberg says over 90 percent of recent submissions were below high.
2
Talos says AI bug mining is flooding Microsoft Patch Tuesday
This month's 1,415 Microsoft advisories far exceed a pre-June average near 100, while exploited bugs rose more slowly.
3
Wheeler supports a separate oss-security list for AI vulnerability reports
He says open-weight models are already viable for finding and fixing flaws, and AI-hardened projects will become hard to attack.
oss-security reply doubts a separate list would end vulnerability volume
Jan Schaumann says reporting stays cheaper than analysis, fixes, and long-term software maintenance.
oss-security poster expects repeating waves of AI vulnerability reports
Martin Steigerwald says fixed AI-found bugs should not be reported again, then harder bugs may follow.
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
Peter Gutmann backs splitting oss-security so Apache CVE floods do not bury the main list.
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
Solar Designer says oss-security volume and subscriber churn remain elevated amid AI vulnerability-report floods.
12 Best Bug Bounty Platforms Compared (2026): Features & Pricing
A 2026 comparison ranks twelve bug bounty platforms, with HackerOne, Bugcrowd, Intigriti, and Synack leading.
10
Flock can now issue CVEs for its own products. Should we trust it?
Flock Safety became a CVE Numbering Authority for vulnerabilities in its own surveillance products.
Reporting vulnerabilities to Estonian companies
A YouTube talk covers how researchers report vulnerabilities to companies in Estonia.
Top 10 Best Bug Bounty Platforms in 2026 [Ranked & Scored]
A 2026 ranking places HackerOne, Bugcrowd, and Intigriti as the leading bug bounty platforms.
9
Anthropic Launches Cyber Mission to Protect Critical Infrastructure and Open-Source Software With Claude AI
Anthropic launched Cyber Mission: Claude-powered critical infrastructure defense with 12 security partners plus a free OSS Scanner for automated vulnerability reports.
Inside the Advisory Database and what happens when vulnerability volume breaks records
GitHub says record vulnerability volume — 1,560 reviewed advisories published in May 2026 — has stretched advisory review times to weeks, urging better report quality.
4
Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports
Google paused paid product-vulnerability reports for its open-source bug bounty after a surge of invalid automated submissions.
4
AI accelerates n-day attacks, as flaw disclosures and exploits double
Google Threat Intelligence says 141 flaws were exploited by August 2026, exceeding all of 2025, with AI tooling accelerating n-day weaponization and shrinking exploit timelines.
5
Google pauses open source bug bounty program after rise in AI submissions
Google paused its open-source bug bounty after invalid, mostly automated AI submissions overwhelmed reviewers.
Google Pauses Open-Source Bug Bounty Program After Flood of Invalid AI-Generated Reports
Google paused new OSS VRP product reports after a flood of mostly invalid AI-generated submissions.
Google Suspends Open-Source Bug Bounty Due to AI Vulnerability Reports
Google paused its open-source bug bounty until 2027 after a surge of invalid AI-generated vulnerability reports.