Click any tag below to further narrow down your results
Links
This Atlantic profile follows Ondřej Surý, a little-known volunteer on PHP security, who suddenly found himself at the center of a major internet-wide vulnerability scare. The excerpt provided is thin, cutting off mid-interview, so the full story of what he did and how it played out isn't visible here.
- Surý was a relatively anonymous volunteer working on PHP security before the incident broke.
- The article frames his work as having a large, sudden impact once the internet "exploded" around the issue.
- The piece sits alongside an Ian Bogost essay on self-replicating AI malware botnets, suggesting the broader concern is AI-driven attack automation.
Anthropic is offering free, fully model-generated security scans to eligible open source projects through a new program called OSS Scanner, with reports delivered without human triage. Early testers say the findings were mostly valid, though the company admits some reports will be wrong.
- Anthropic's models found over 29,000 candidate vulnerabilities in six months, but only about 6,000 have been manually reviewed, so human review is the bottleneck.
- OSS Scanner reports go out unverified, but in a pilot, 85 of 97 critical and high-severity findings (88%) met the bar for Anthropic's disclosure process, and only one was a false positive.
- Eligible projects get reports with a reproducer, an explanation, and often a candidate patch; several maintainers said the reports were high quality, and some chained bugs into unauthenticated remote code execution.
This is a news digest from The Register covering major developments across AI, infrastructure, security, and open source — including TSMC's US expansion, Microsoft's AI agent plans, Russian phishing campaigns, and various software releases.
- TSMC is partnering with GlobalFoundries on a $2B deal to boost US production of silicon interposers needed for AI datacenter chips
- Microsoft is integrating Copilot agents into Windows file systems and replacing Intel processors with Nvidia SoCs in Surface Laptop Ultra, starting at $2,599
- Russian attackers are impersonating Signal support to run phishing campaigns, and Microsoft's SharePoint on-premises servers are under active zero-day attack with unpatched vulnerabilities
- Ubuntu's new beta adds Rust components and LLM-based speech-to-text; Firefox 157 gets a significant visual redesign; KDE turns 30 with an AI-native desktop proposal
Quodeq is an MIT-licensed tool that runs locally to scan codebases using AI across six ISO 25010 dimensions, mapping each finding to CWE identifiers and providing fix plans. It supports cloud and local models, outputs grades and violations in JSON, and includes a dashboard for exploring results and defining custom standards.
- Quodeq is a free, local, MIT-licensed AI scanner that grades code A–F across six ISO 25010 dimensions and maps findings to CWE IDs with concrete fix plans.
- It works with either cloud models (Claude, Gemini, Codex) or fully local models via Ollama, so scans can run with no telemetry or accounts.
- Sample output catches real-world issues like SQL injection, hardcoded credentials, missing rate limiting, and bare-except clauses, each with file/line references and code snippets.
- Install via pipx/pip and run from CLI or an Electron dashboard with heatmaps, trend graphs, and support for custom rule sets like Clean Architecture or DDD.
OpenAI is rolling out a new tiered Trusted Access for Cyber (TAC) program, letting verified security professionals use GPT-5.4-Cyber—a version fine-tuned for defensive tasks and binary reverse engineering. Access requires identity checks and may include restrictions like zero-data retention for high-sensitivity use cases.
- OpenAI is gating its most capable cyber model (GPT-5.4-Cyber) behind identity verification/KYC, only for vetted defenders
- Codex Security has already fixed 3,000+ high/critical vulnerabilities and helped 1,000+ open-source projects during a 6-month beta
- OpenAI classified GPT-5.4 as "high" cyber capability under its own Preparedness Framework, signaling real offensive potential that requires these access controls
- They've committed $10M to a Cybersecurity Grant Program alongside the Linux Foundation to shore up open-source security broadly
User feedback is highly valued and taken seriously by the team. For a comprehensive list of available qualifiers, users are directed to the documentation. An error occurred while loading the page, prompting a reload.
- The page failed to load properly, so the actual leaked Anthropic system prompt content isn't accessible in this summary
- The repository (x1xhlol/system-prompts-and-models-of-ai-tools) compiles system prompts from AI tools, positioning it as a reference resource rather than original commentary