#softwaresecurity

The FreeBSD Foundation's AI-Assisted Vulnerability Discovery Project continues to explore ways to strengthen FreeBSD's security processes through improved tooling, automation, and community collaboration. In the August and September 2026 project update, we share progress on several initiatives. Read the full project update: https://github.com/FreeBSDFoundation/all-projects/blob/main/AI-assisted-vulnerability-discovery/monthly-updates/2026-09.md #FreeBSD #OpenSource #Cybersecurity #SoftwareSecurity

One small change can make a big difference in software supply chain security. PyPI has introduced a new safeguard that rejects uploads of new files to package releases older than 14 days. This helps prevent attackers who compromise a maintainer’s account or publishing pipeline from silently adding malicious files to a long-trusted package version months after it was released. While this doesn’t eliminate all supply chain threats, it significantly reduces the risk of “package poisoning” attacks against pinned dependencies and encourages immutable releases, a security best practice every ecosystem should strive for. Security isn’t about a single silver bullet, it’s about layering defenses that make attacks increasingly difficult. Could we see similar protections become the standard across other package registries like npm, NuGet, and RubyGems? https://cybersecuritynews.com/pypi-14-day-release-lock/amp/ #CyberSecurity #AppSec #SupplyChainSecurity #PyPI #Python #DevSecOps #SoftwareSecurity #OpenSource #SecureByDesign #SoftwareSupplyChain #Infosec

GitHub updates its bug bounty program on July 27, cutting public payouts while moving maximum rewards to an invite-only VIP program. #GitHub #BugBounty #Cybersecurity #InfoSec #SoftwareSecurity

Reasons you still need a human in the loop: "Researcher poisons open-weight AI model for under $100 https://share.google/6GPUoUdIMJG8EFPWh" Besides the occasional hallucinations, the lack of creativity, and an inability to encode certain types of info into the models (at least for now), #security is a huge issue. A #developer experienced in spotting malicious code and exploitable patterns can catch this sort of issue as often as in regular code reviews. #softwareDevelopment #AI #softwaresecurity