1_DevOps'ish

You can now build your own pack of agent skills from the skills.sh directory, letting you download and update multiple skills with a single command.

SemiAnalysis thinks the DeepMind shakeup means Google is losing the AI race. It might be that Google is choosing to run a different race.

Claude Code will soon run auto mode by default for Pro, Max, and Team plans, enabling longer-running autonomous work, and catching more dangerous commands.

Anthropic, Meta and OpenAI have all had incidents of AI models hacking other companies during cybersecurity testing.

Some lessons are learned the hard way....or in this case, the looong way.

Defenders are increasingly turning to LLMs to to generate vulnerability patches. But our research showed that LLMs only successfully generate patches (without materially changing application behavior) 26% of the time.

In addition to the Linux kernel staging area now rejecting AI/LLM-generated patches except for real security fixes, the Linux wireless networking code is also seeing some shifts around how it will deal with AI/LLM generated patches.

Summary A use-after-free vulnerability in the Linux kernel bridge (net/bridge) Spanning Tree Protocol (STP) implementation. A bridge that is administratively down while kernel STP is enabled, together with a port driven into the LEARNING state, arms periodic STP timers without an IFF_UP guard. The teardown path taken by dellink never synchronously deletes those timers, so … Linux Bridge STP Timer Use-After-Free Read More »

Apple has imposed strict new submission limits on its bug bounty portal after finding itself overwhelmed by low-quality, AI generated vulnerability reports - many of which were found to be describing security flaws that simply didn't exist.

4.1K likes. "Black Hat USA 2026: The 'Breaking' News: The OpenAI–Hu...

Security researchers say that Kimi K3, an open-weight model from China, wandered off to the internet in an attempt to cheat on a test it was given.

Discover how to find the best Mario Kart 8 build using the Pareto frontier method. This interactive guide explores multi-objective optimization of speed, acceleration, and other key stats to help you beat your friends on the race track.

43 likes, 2 comments. "My thoughts on AI and Open Source"

Why attacks that look like normal traffic are the hardest to stop. How L3/4 and L7 defenses differ, and what four real DDoS incidents reveal about each.

I asked all 11 Massachusetts DAs for their case data. Six million charges came back. The system holding them is "obsolete" — and its replacement is being bought right now, in silence.

Meta is the latest company to disclose an AI agent breach, raising cyber-security concerns.

A security practitioner's account of running Claude Mythos Preview in a vulnerability-hunting harness for 30 days: where it proved exploits and what it cost ($42K).

HashiCorp has released a public beta of Vault Kubernetes key management, a KMS v2-compatible plugin that lets the Kubernetes API server delegate envelope encryption to Vault Enterprise, moving the key encryption keys that protect etcd data out of the cluster and into a separately governed trust domain.

This essay originally appeared in Foreign Policy. Earlier this month, two of OpenAI’s models broke out of their containment sandbox and attacked another AI company. The story is kind of wild. OpenAI was running security tests on two of its models: GPT-5.6 Sol and an unreleased model that is almost certainly GPT-6. In particular, it was running the ExploitGym benchmark, which measures how good a model is at turning security vulnerabilities into working exploits: basically, offensive cyberattacks. Since these were internal tests, OpenAI locked those models in a secure sandbox that denied them access to the internet. But it was running the models without any safety filters that would prevent them from offensive cyber-actions. That meant that there was nothing to prevent the models from trying to ...

Self-host LLM inference when you clear ~2M tokens a day or face data-privacy rules. Below that, an API is cheaper. Most teams want a hybrid.

GitHub Stacked PRs

For nearly two years, researcher Vangelis Stykas has maintained access to North Korean hackers’ servers. His work shows they pulled off intrusions in a shocking number of systems across the globe.

The misbehavior is called reward hacking. This is what you need to know.

The discovery comes after OpenAI's Hugging Face breach last month.

The JFrog security research team recently identified a supply chain attack targeting the `xinference` package on PyPI. Versions 2.6.0, 2.6.1, and 2.6.2 were compromised and yanked by maintainers after users reported suspicious behavior. If you installed or imported these versions, you must assume your environment is compromised.

Go supply chain security, step by step: govulncheck, pinning, SBOM, container scan, secrets, GitHub Actions hardening, and signing.

Top scores increased by 5x.

Explore how passkey implementation gaps undermine security when relying parties fail to validate the User Verified flag, reducing MFA to a single factor.

We are actively investigating a coordinated malware campaign affecting a broad set of highly downloaded packages by Jared Wray (GitHub) and affecting the cacheable ecosystem.