Posts of last few hours

Witness is an open-source command-line tool that records how software gets built, signs that record, and checks it against a policy before the software ships. TestifySec built Witness and donated it to the in-toto ecosystem within the Cloud Native Computing Foundation, and an open community now maintains it. A compiled binary doesn’t say which machine built it or what code went in. Witness lets a team check which command produced the file, which materials went … More →

The post Witness: Open-source framework for verifying how your software was built appeared first on Help Net Security.

The maintainers of large open source projects are taking the worst of the AI slop. In a Linux Foundation survey of 234 open source contributors and maintainers, people running projects with more than 50 contributors estimated that close to a third of the code changes landing in their queue are low quality or AI-generated. Those maintainers now worry more about burning out than about the code itself. Across all projects, the estimate comes to about … More →

The post AI slop is piling up highest on the biggest open-source projects appeared first on Help Net Security.

An AI SOC that starts with somebody else’s alert is already too late. Stellar Cyber collects and normalizes telemetry, detects suspicious activity, correlates evidence, builds cases, investigates incidents, triages findings, and drives response from the same security architecture. That gives people and AI access to the evidence behind the alert – not just the alert itself. Full-cycle security operations means the data, detections, context, investigation, decisions, and response remain connected as an incident moves through … More →

The post Product showcase: Stellar Cyber’s ISOC platform provides full-cycle architecture appeared first on Help Net Security.

AI agents that have not run recently retain credentials and connections to company systems, according to Arrakis Security’s 2026 Autonomous Agents Threat Report. About 76% of enabled agents examined had not run in 60 days, leaving access available through inactive software. Agents by exposure family (Source: Arrakis Security) The analysis covered thousands of agents in customer production environments over a 12-week period. These programs can read and write data, call tools and start workflows, giving … More →

The post Forgotten AI agents may still access sensitive company data appeared first on Help Net Security.

Criminals are exploiting established customer accounts and familiar brands to steal money and personal information, according to TransUnion’s Fraud in the Age of Continuous Trust report. Eighty-one percent of suspected digital fraud in its network during the first half of 2026 occurred during account logins and financial transactions, highlighting risks that persist throughout a customer relationship. Verifying someone’s identity does not establish whether every subsequent interaction can be trusted. Scammers can manipulate legitimate customers into … More →

The post Synthetic identities leave US lenders with $2.4 billion in fraud exposure appeared first on Help Net Security.

Moderators of r/opensource, Reddit’s catch-all forum for open source software, have barred any project that “uses AI, is made by AI, or is intended for AI.” Moderator Wolvereness announced the rules in a post over the weekend. A project now has to be at least a year old and actively maintained, carry an OSI license, have an existing community and “subjectively 3+” contributors. The poster needs a Reddit account at least a year old with … More →

The post r/opensource bans AI projects, and solo devs go down with them appeared first on Help Net Security.

Google has open-sourced the Elephant-Goldfish Model plugin, an internal tool that makes an AI coding agent write and defend a design document before it touches any code. The plugin hands that document to fresh AI sessions that have never seen the design conversation and tells them to find what is wrong with it. The EGM plugin in a nutshell (Source: Google) “AI-powered velocity is transformative; however, it has silently introduced a potential reliability crisis by … More →

The post Google open-sources the Elephant-Goldfish Model plugin its engineers use to catch AI coding mistakes appeared first on Help Net Security.

Securing the control plane that your Kubernetes strategy depends on. As enterprise containerization accelerates on VMware Cloud Foundation (VCF), the vSphere Supervisor becomes the central focal point of both operation and platform risk. Securing tenant applications alone is insufficient – organizations must safeguard the infrastructure and control plane beneath them. VMware vDefend delivers a multi-layered, … Continued

The post Protecting the vSphere Kubernetes Control Plane: Architecting Zero Trust for Supervisor and VKS with vDefend appeared first on VMware Security Blog.