❌

Visualização normal

Ontem — 7 de Novembro de 2026Cybersecurity News
  • ✇Security | CIO
  • OpenAI buys tiny software developer to improve Codex
    OpenAI is buying Pierre Computer Company in order to incorporate the San Francisco-based software developer’s Code.Storage infrastructure layer for Git into its Codex AI-powered programming tool. Pierre Computer, whose employees number just barely in the double digits, has got plenty of clout for its small size. It’s well-known for Code.Storage offering, as well as for its open-source software libraries, Trees and Diffs, which OpenAI already uses in Codex. OpenAI has
     

OpenAI buys tiny software developer to improve Codex

6 de Novembro de 2026, 10:42

OpenAI is buying Pierre Computer Company in order to incorporate the San Francisco-based software developer’s Code.Storage infrastructure layer for Git into its Codex AI-powered programming tool.

Pierre Computer, whose employees number just barely in the double digits, has got plenty of clout for its small size. It’s well-known for Code.Storage offering, as well as for its open-source software libraries, Trees and Diffs, which OpenAI already uses in Codex.

OpenAI has experienced some of the limitations of Git itself, and its in-house engineering teams are already working to improve its support for human coders and AI agents working in parallel. Earlier this week the company described how it built a new back end for Git repositories, Pando, to enable concurrent working at scale.

The AI developer has been pushing Codex more aggressively this year: offering it to Mac users and expanding it to Windows. It cited Pierre Computer’s ability to help developers review code as one of the reasons for the acquisition. OpenAI highlighted the Diffs’ Edit mode and the recently released Highlights as components that were particularly helpful to development teams.

Announcing the deal on its news page, OpenAI set out how it would integrate the company into its existing offerings. “With the Pierre team, we wish to set the standard for modern software development: from the first branch an agent creates to that magic moment when code is deployed to the world. We want to make Codex the place where developers and agents take on their most ambitious projects.”

Neither company disclosed details of the acquisition price. OpenAI said that Code.Storage customers will be able to continue using the product until it brings the features into Codex, while Pierre Computer’s open-source projects will remain open, and OpenAI will continue to contribute to them.

This article first appeared on InfoWorld.

Antes de ontemCybersecurity News
  • ✇Cybersecurity News
  • Linux 7.4 Merge Window Sets Record with AI Patches Do Son
    The Linux 7.4 merge window reached a record 19,671 commits as Linus Torvalds highlighted early AI patches and major hardware support. Related Posts: OpenBSD 8.0 Release Introduces Kernel Hardening and Day-One Errata GNOME OS Preview Brings GNOME 51.1 to the Public Linux Assisted-by Tag Dropped for AI Patches The post Linux 7.4 Merge Window Sets Record with AI Patches appeared first on Daily CyberSecurity.
     
  • ✇Cybersecurity News
  • Details and PoC Exploits Released for Two Unpatched free5GC Vulnerabilities Do Son
    Details and PoC are public for two unpatched free5GC vulnerabilities in the 5G core: BSF auth bypass CVE-2026-115926 and an exposed root CA key. Related Posts: Kerio Connect Vulnerability CVE-2026-112353 Exploited in the Wild to Steal Mailboxes Apache Kafka Fixes 12 Vulnerabilities, Including a JWT Bypass That Grants Full Cluster Access FreeSWITCH Vulnerability CVE-2026-116779 Exploited in the Wild to Run Commands The post Details and PoC Exploits Released for Two Unpatched free5GC Vulnerabil
     
  • ✇Cybersecurity News
  • Denmark Ends Collabora Pilot in Blow to Open Source Do Son
    Denmark ends Collabora pilot testing across its public sector after formatting errors disrupted case workflows, securing a quiet victory for Microsoft. Related Posts: Microsoft Voluntary Buyout Program Targets 60,000 Staff Apple Blocks eMudhra Certificates Over Weak Key Flaw Anthropic S-1 IPO Filing Targets Historic $2T Valuation The post Denmark Ends Collabora Pilot in Blow to Open Source appeared first on Daily CyberSecurity.
     

What is PHP and how serious is the computer language flaw causing website shutdowns?

An estimated 70% of websites use the open-source language. What is the identified vulnerability in it?

Website owners faced millions of attempts to exploit a serious security vulnerability in their programming language, it has emerged, triggering a rush by governments and businesses to fix the problem.

The newly discovered vulnerabilities in PHP, a programming language that underpins most websites, allows hackers to carry out cyber-attacks and steal data if not fixed. What were the vulnerabilities and why did they affect so many sites?

Continue reading...

© Photograph: ANP/Shutterstock

© Photograph: ANP/Shutterstock

© Photograph: ANP/Shutterstock

  • ✇Cybersecurity News
  • GNOME OS Preview Brings GNOME 51.1 to the Public Do Son
    The GNOME OS preview is now public with GNOME 51.1, offering x64 and Arm64 images for a real PC or a virtual machine. Related Posts: Linux Assisted-by Tag Dropped for AI Patches Ubuntu 26.10 Release Brings Rust Core and GNOME 51 Claude Code Linux Kernel Patch Triples Read Speeds The post GNOME OS Preview Brings GNOME 51.1 to the Public appeared first on Daily CyberSecurity.
     
  • ✇Cybersecurity News
  • Linux Assisted-by Tag Dropped for AI Patches Do Son
    The Linux Assisted-by tag is going away after maintainers agreed it misreports AI use, but human accountability stays. Related Posts: GNOME OS Preview Brings GNOME 51.1 to the Public Ubuntu 26.10 Release Brings Rust Core and GNOME 51 Claude Code Linux Kernel Patch Triples Read Speeds The post Linux Assisted-by Tag Dropped for AI Patches appeared first on Daily CyberSecurity.
     
  • ✇Cybersecurity News
  • npm Trusted Publishing Now Expires After 48 Hours Do Son
    GitHub now expires npm trusted publishing setups that miss a first publish within 48 hours, closing a repo name reuse flaw in 1,500+ packages. Related Posts: Google Updates Chrome VRP Rewards for Memory Flaws Google Play AI Apps Revolutionize Android Publishing Google Gemini 4 Argon Model Officially Launches The post npm Trusted Publishing Now Expires After 48 Hours appeared first on Daily CyberSecurity.
     
  • ✇Cybersecurity News
  • Bitwarden App Store License Changes to Commercial Model Do Son
    Discover the new Bitwarden app store license changes. Learn how the shift from GPLv3 to a commercial model affects future updates and self-hosted versions. Related Posts: Anthropic Fortifies Claude AI Against Model Distillation Firefox 158.0 Released: Default JPEG XL Support Intel Implements Significant Price Increases on PC Processors The post Bitwarden App Store License Changes to Commercial Model appeared first on Daily CyberSecurity.
     
  • ✇Cybersecurity News
  • Ubuntu 27.04 Release Schedule: Tenacious T-Rex Do Son
    Discover the Ubuntu 27.04 release schedule. Code-named Tenacious T-Rex, this interim release brings new features and kernels for desktop enthusiasts. Related Posts: Raspberry Pi OS Update: Squashing Desktop Bugs Ubuntu 26.04 Upgrade Now Open to 24.04 LTS Users Canonical Overhauls Ubuntu Kernel Release Cycle The post Ubuntu 27.04 Release Schedule: Tenacious T-Rex appeared first on Daily CyberSecurity.
     

Ubuntu 27.04 Release Schedule: Tenacious T-Rex

Por:Do Son
13 de Outubro de 2026, 06:14

Discover the Ubuntu 27.04 release schedule. Code-named Tenacious T-Rex, this interim release brings new features and kernels for desktop enthusiasts.

Related Posts:

The post Ubuntu 27.04 Release Schedule: Tenacious T-Rex appeared first on Daily CyberSecurity.

  • ✇Cybersecurity News
  • Official Ubuntu RISC-V Desktop Image Unveiled Do Son
    Canonical announces the first official Ubuntu RISC-V desktop image. Discover the new features, QEMU emulation support, and hardware requirements. Related Posts: RD Web Access Breaks as Chrome Drops XSLT Support Run Googlebook OS on MacBook via QEMU Virtualization Google AI Edge Foresight: A Free Offline Mac Tool The post Official Ubuntu RISC-V Desktop Image Unveiled appeared first on Daily CyberSecurity.
     

Official Ubuntu RISC-V Desktop Image Unveiled

Por:Do Son
11 de Outubro de 2026, 22:43

Canonical announces the first official Ubuntu RISC-V desktop image. Discover the new features, QEMU emulation support, and hardware requirements.

Related Posts:

The post Official Ubuntu RISC-V Desktop Image Unveiled appeared first on Daily CyberSecurity.

  • ✇Cybersecurity News
  • Anthropic Introduces OSS Scanner for Open Source Projects Do Son
    Discover the Anthropic OSS Scanner. Learn how AI models provide automated vulnerability scanning and remediation for open source projects. Related Posts: Claude AI Unintended Actions Lead to Offline Evaluations Controversy Surrounding the .lan Domain Application OpenAI GPT-6 Introduces Revolutionary Intelligent UI The post Anthropic Introduces OSS Scanner for Open Source Projects appeared first on Daily CyberSecurity.
     

Dutch Tax Agency Reverses Microsoft 365 Cloud Migration Over Data Risks

7 de Outubro de 2026, 10:34

The Dutch Tax and Customs Administration is reversing a planned Microsoft 365 cloud migration as officials seek greater control over sensitive government data.

The post Dutch Tax Agency Reverses Microsoft 365 Cloud Migration Over Data Risks appeared first on TechRepublic.

  • ✇Cybersecurity News
  • Meta Muse Gadgets: Open-Source Hardware for the Muse AI Do Son
    Meta Muse Gadgets is an open-source project that lets makers build Muse AI hardware, with ESP32 firmware, a Linux SDK, and a free dongle. Related Posts: Apple Restricts Full Disk Access for macOS AI Agents iPhone 18 AT&T Issue: Navigating the Cellular Crisis OpenAI AI Safety Whistleblower Warns of Culture Collapse The post Meta Muse Gadgets: Open-Source Hardware for the Muse AI appeared first on Daily CyberSecurity.
     
  • ✇Cybersecurity News
  • Stirling PDF RCE CVE-2026-85714: Details and PoC Publicly Disclosed Do Son
    Details and a PoC are public for CVE-2026-85714, a 9.1 Stirling PDF RCE via crafted SQL import. Upgrade to version 2.13.2 now. Related Posts: Citrix NetScaler CVE-2026-88779 Exploited in the Wild to Knock SAML Gateways Offline Unpatched Apache OpenOffice Vulnerability Leads New Apache Advisories for LDAP API and Traffic Server Microsoft Reissues September 2026 Exchange Server Security Updates to Add CVE-2026-96940 The post Stirling PDF RCE CVE-2026-85714: Details and PoC Publicly Disclosed ap
     
  • ✇The Cloudflare Blog
  • One year later: Sovereign AI and the fight for choice Carly Ramsey · Smrithi Ramesh · Petra Arts
    It's Birthday Week, when we traditionally ship presents to the Internet. This year, two of them come from Europe: EuroLLM, which covers all 24 official EU languages, and Apertus, Switzerland's fully open model, trained on more than 1,500 languages. Both were built by public universities and research institutions. Both are coming to Workers AI, and you can request access today.We're also launching hands-on workshops that help government cyber agencies and critical infrastructure operators build A
     

One year later: Sovereign AI and the fight for choice

1 de Outubro de 2026, 10:04

It's Birthday Week, when we traditionally ship presents to the Internet. This year, two of them come from Europe: EuroLLM, which covers all 24 official EU languages, and Apertus, Switzerland's fully open model, trained on more than 1,500 languages. Both were built by public universities and research institutions. Both are coming to Workers AI, and you can request access today.

We're also launching hands-on workshops that help government cyber agencies and critical infrastructure operators build AI defenses that work with any model. The first runs in Singapore in October.

Today's announcements follow from an argument we made a year ago, when questions about AI access and sovereignty were swirling in national capitals. Our answer was choice: the freedom to pick the right tools for the job, and to switch when you need to.

Since then, those conversations have hardened. Attackers have used frontier models to run cyber attacks. Access to some frontier models now depends on where you are. Calls to restrict open models are getting louder. Put it all together and it's easy to conclude that AI sovereignty is zero-sum: every model another country controls is one you can't count on, so the safe move is to build walls.

We think the past year can point the other way. India, Japan and Singapore focused on open-sourced models, and people across Asia-Pacific built tools on them for rural citizens, elderly patients and the nurses who care for them. Our own security team built AI defenses that work with any model, so losing access to one doesn't mean losing your defenses.

Helping build a better Internet has always meant more options, not fewer. That's why we work on open standards that prevent vendor lock-in, why so much of what we build is free to start with, and why our network runs in more than 335 cities across 125+ countries, with GPUs for AI inference in more than 230 of them. We don't think any country should have to depend on one company for its AI. That includes us.

Two European open models on Workers AI

In February, Matthew Prince told the India AI Impact Summit 2026 in New Delhi that decentralized, affordable access to AI is a matter of national resilience. The models from India, Japan and Singapore we'd added a few months earlier were our first proof. The summit series moves to Geneva in June 2027, with a mission of "prosperity and progress for all."

EuroLLM supports 35 languages, including all 24 official EU languages, many of which are underserved by existing open models. It was developed with support from Horizon Europe, the European Research Council and EuroHPC by a consortium that includes Instituto Superior Técnico, the University of Edinburgh, Instituto de Telecomunicações, Université Paris-Saclay, Unbabel, Sorbonne University, Naver Labs and the University of Amsterdam. It was trained on the MareNostrum 5 supercomputer and, according to the consortium, outperforms similar-sized models on EU multilingual benchmarks and machine translation.

You can request access to EuroLLM on Workers AI here.

Apertus (Latin for "open") is Switzerland's first large-scale, fully open, multilingual language model. It was trained on more than 15 trillion tokens across more than 1,500 languages, with 40% of training data in languages other than English. It was developed by ETH Zurich, EPFL and the Swiss National Supercomputing Centre (CSCS) as part of the Swiss AI Initiative: built by public institutions, for the public good. Its architecture, weights, training data and methods are all published. It was designed with Swiss and European rules such as the EU AI Act and GDPR in mind, which means respecting training opt-outs, removing personal data and preventing memorization. It was trained on CSCS's Alps supercomputer (more than 10,000 GH200 GPUs), and its developers report that it significantly outperforms leading closed and open models on rare and regional languages, from Romansh and Swiss German to low-resource languages across Asia and Africa.

You can request access to Apertus on Workers AI here.

What people built last year

Last year's national models didn't sit on a shelf. Since we added them to Workers AI, hundreds of students, startups, small businesses and public servants across Asia-Pacific have built on them, many at buildathons we ran with local partners. Three of them:

  • Government forms, no reading required – Form Mitra (India): Benefit forms written in dense English shut out many of the rural, low-literacy and visually impaired citizens they're meant for. Students at the Indian Institute of Technology Delhi built Form Mitra at a buildathon we ran with CyberPeace: a voice-guided assistant that walks people through the form in any of 22 Indian languages, using AI4Bharat's IndicTrans2 model.
  • Care in the patient's own dialect – MedBridge (Singapore): Many of the nurses caring for Singapore's elderly patients come from across Southeast Asia and don't speak the local dialects, so critical clinical information can get lost in translation. MedBridge guides patients through health conversations in 14 languages, including Hokkien and Cantonese.
  • The right public service, in one tap – Anshin Concierge (Japan): For elderly residents, people with disabilities and anyone less comfortable with digital tools, working out which public service to call in a moment of need can be overwhelming. Built as a hackathon prototype, Anshin Concierge lets people describe the problem in their own words ("my knees hurt", "a strange screen appeared on my phone") and connects them to the right Tokyo Metropolitan Government support desk, by phone or web page, in one tap. 

AI defenses that don't depend on one model

Governments want to use AI to defend essential services and national infrastructure. The frontier models that can find vulnerabilities at scale can find them for defenders too. But a defense built on one model is only as dependable as your access to that model, and governments have watched access to critical models get constrained with little warning.

We had the same problem, and in security we are always our own first customer. Over the past year, our Security team, working with teams across the company, set out to build AI defenses that don't depend on any one model. We built a harness: an orchestration layer that coordinates multiple AI models working in parallel to hunt for vulnerabilities, verify findings and prioritize threats. We published what we learned about using frontier and open models together, open-sourced the harness so any organization can run it with the models of its choice, and laid out the layered architecture we use to stop attackers armed with frontier models from finding vulnerabilities in the first place.

Because the harness works with any model, closed or open, losing access to one provider doesn't switch your defenses off. When we walked governments through it, the most common reaction was relief. Then came the practical questions: how to stand it up in their own environments, under their own rules. Briefings quickly turned into requests for hands-on training.

So today we're launching a program of hands-on workshops for government cybersecurity agencies and critical infrastructure operators. Participants build their own AI security harness and layered defenses, and leave knowing how to adapt both to their organization. The modules are plug-and-play, designed to slot into national AI skilling and cyber resilience programs. The first workshop runs in Singapore this October, at Singapore International Cyber Week.

Come build with us

None of this happened alone. Partners like CyberPeace in India and Code for Japan helped turn open models into working tools. If you run a national AI program, a cyber agency or critical infrastructure, and you'd like more options than you have today, write to us at policy-team@cloudflare.com. Request access to EuroLLM and Apertus, or start with the harness.

A year ago, we said choice is the path to AI sovereignty. This year showed it's the path to AI security, too.

  • ✇Security | CIO
  • AWS bets that AI agents need an inbox, not another chat window
    AWS is betting that AI agents need a different interface as they move beyond answering prompts and start working autonomously in the background. The company has open-sourced Pizza Bot, a self-hosted application that gives users an inbox for managing work delegated to AI agents, with separate threads for ongoing tasks and a queue for work that is completed or needs human input, rather than keeping the management of agents restricted inside a conventional chat window. The
     

AWS bets that AI agents need an inbox, not another chat window

16 de Setembro de 2026, 13:06

AWS is betting that AI agents need a different interface as they move beyond answering prompts and start working autonomously in the background.

The company has open-sourced Pizza Bot, a self-hosted application that gives users an inbox for managing work delegated to AI agents, with separate threads for ongoing tasks and a queue for work that is completed or needs human input, rather than keeping the management of agents restricted inside a conventional chat window.

The rationale, according to AWS, is that background agents do not always need a user’s attention while they work and an inbox model will let users hand off longer-running tasks, return to them later, and see which jobs are complete or require intervention.

Under the hood

That approach is reflected in how the inbox organizes work with the help of an “All” tab that contains the history of each task or conversation, including the agent’s messages and work performed, the “Unread” tab that flags completed work that users have yet to review, and an “Action” tab that surfaces tasks paused while waiting for user input or approval.

The inbox interface also has a panel named Activity that shows users how an agent handled a particular task along with the transcript, AWS wrote in a blog post introducing Pizza Bot.

AWS’ inbox-oriented rationale also extends to Pizza Bot’s architecture.

It uses LangChain’s Deep Agents as the harness and LangGraph as the stateful runtime, with a combination of the two allowing an agent to checkpoint its progress as it works, preserving its messages, tool activity and current state so a task can be paused and resumed rather than being tied to a live chat session, the hyperscaler wrote.

Pizza Bot’s server sits on top of that stack, connecting the agent runtime with the user interface, skills, MCP servers and the model provider, with developers able to choose from Anthropic, OpenAI, Google Gemini and Amazon Bedrock, as well as local models through Ollama, it added.

As for its out-of-the-box capabilities, the application comes with skills for working with files, browsing the web and delegating tasks to specialist agents. Developers can also add existing Agent Skills and MCP servers to give the agents access to other tools and services, the hyperscaler wrote.

Enterprise integration could remain a hurdle

However, analysts were not too convinced that Pizza Bot’s out-of-the-box skills and support for existing tools will make its implementation easier for enterprises.

While the out-of-the-box capabilities and added support for existing skills saves enterprise teams the time to build the application, it leaves out the integration work required to make it work, said Bhupendra Chopra, chief revenue officer at IT consulting firm Kanerika.

“Integration is where most of the money in an enterprise agent deployment goes. A sales or finance team gets value from an agent when it can read and update CRM, email and ERP, and each of those systems needs a connector someone has to build, secure and maintain,” Chopra pointed out.

Pizza Bot’s integration could be further complicated by the application’s lack of support or any SLA, according to Manoj Chandra Jha, principal analyst at Nord-IQ Research. That means the integration and operational burden ultimately falls on enterprises, who would be responsible for running, securing and maintaining the open source software themselves, Jha said.

Rise in enterprise productivity likely

But for enterprises willing to take on that integration work, the inbox-oriented approach could improve productivity.

“It’s a meaningful shift because it changes the economics of delegating work to agents. A chat interface requires a person’s attention throughout the task, while an inbox brings them in only when their judgment is needed, much like how executives delegate work to their teams,” Chopra said.

“Coding agents have already demonstrated this model, where an engineer assigns an issue and reviews the resulting pull request. Pizza Bot extends that approach to tasks such as meeting preparation and follow-ups,” Chopra added.

Further, the analyst pointed out that the inbox-oriented approach could give enterprise teams a clearer window into how scheduled tasks perform.

“For scheduled tasks, having the results delivered as threads gives users a way to track what happened in the background and spot failures that might otherwise go unnoticed,” Chopra said.

Out of sight, out of mind

There are risks with this approach, however: “The inbox model can make bad work less visible. When somebody is watching an agent in a chat window, they can see it going off the rails,” said Phil Fersht, CEO of HFS Research.

In contrast, when hundreds of tasks are running quietly in the background, users may not see an agent making mistakes until the task is complete or an exception requires their attention, potentially making problems harder to catch early, Fersht said.

That reduced visibility can also create approval fatigue, according to Chopra.

“An agent sending back dozens of threads with multiple approval requests can condition users to approve them without reading them closely,” Chopra said.

There is also a risk in the delay between an agent preparing an action and a user approving it: “Information that was current when the agent paused may no longer be valid hours later, potentially resulting in an outdated CRM update or a meeting invite for a slot that is no longer available,” he said. “An assumption that might be caught in a live chat can go unchallenged as the agent continues building on it and consuming model resources. Scheduled runs can also add costs without anyone watching them in real time.”

Those disadvantages can be countered by designing processes with fewer, better-timed approval points, and verifying that the underlying data is still current before allowing an action to execute, he said.

Adoption likely to start with technical teams

Such tradeoffs are likely to shape where Pizza Bot gains traction.

“Adoption will likely be bottom-up, with individual technologists and small platform teams drawn to Pizza Bot’s control and standards-based design,” Jha said. “Risk-averse industries, especially ones in the regulated sectors, and business users with limited technical expertise, however, are likely to approach the application more cautiously,” he added.

That could leave Pizza Bot occupying a more targeted role in the enterprise, as a way for technical teams to experiment with asynchronous agents and new ways of delegating work, rather than an immediate replacement for the governed interfaces and managed services enterprises typically use for business-critical processes, he said.

This article first appeared on InfoWorld.

  • ✇Cybersecurity News
  • OpenAI Expands Codex for Open Source Sponsorship Program Do Son
    Discover how OpenAI expanded the second round of its Codex for Open Source program to 10,000 slots, offering ChatGPT Pro 5x and valuable API credits. Related Posts: Google Home Adds MCP Support for AI Agent Control Google Unveils Gemini Live Voice Models for Advanced Reasoning Google Schedules "Opening Night" for the Googlebook The post OpenAI Expands Codex for Open Source Sponsorship Program appeared first on Daily CyberSecurity.
     

Shai-Hulud hackers: two men charged over TeamPCP’s global supply chain crime spree that hit OpenAI, and thousands more

28 de Agosto de 2026, 07:23
More than 1,000 organisations, 500,000 stolen credentials, and one self-propagating worm named after a Dune sandworm - two men now face charges over TeamPCP's global hacking spree. Read more in my article on the Hot for Security blog.
❌
❌