Topic
The practice of finding, disclosing, and fixing vulnerabilities in open-source code and the dependencies commercial software builds on.
Anthropic's OSS Scanner sends maintainers Mythos findings before its researchers review them, with about 6,000 of 29,000-plus candidates triaged. The service is free and opt-in, and reports carry reproduction steps and proposed fixes where available.
Reality
Curl ended its bug bounty in January 2026 after AI-written reports cut its confirmed rate below 5%, a dev.to post says. The post's own shares and rates explain only a small part of that drop.
Reality
FFmpeg 8.1.2 fixes CVE-2026-8461, a CVSS 8.8 heap out-of-bounds write in the libavcodec MagicYUV decoder that JFrog found. A dev.to post-mortem says a crafted .avi thumbnailed by a file manager reaches it, so anything linking libavcodec needs a version check.
Reality
Akrites CTO Christopher Robinson estimates one security pull request can take an engineer up to eight hours to review. The Linux Foundation announced the shared response team in June to consolidate and validate vulnerability reports.
Reality
OpenAI is reportedly in early talks to buy Trail of Bits, with no price disclosed. Crypto Briefing reported that CrowdStrike fell about 3% to around $254 on Oct. 14, Palo Alto about 4% and Fortinet more than 3%.
Perspective Coverage
5 publishersReality
curl 8.23.0 shipped 24 security fixes nine months after the project closed its bug bounty over low-quality reports. The explanation on offer, a human check before each submission, is one auditor's reading.
Reality
Lightwell says it found CVE-2026-92877, a zero-day in JAXB, a library inside thousands of enterprise software packages. Teams running application servers must still work out whether they carry it and whether their version gets the fix.
Reality
Kestra's AuthenticationFilter skips authentication for any request path ending in "/configs", letting an unauthenticated attacker reach root remote code execution. Naming a flow "configs" is enough, because the REST API puts the flow name in the path. The bug is CVE-2026-49869.
Reality
Anthropic's Claude flagged more than 29,000 candidate open source vulnerabilities in six months, and upstream projects have patched 516 of them. Maintainers praise the reports, but each fix still ships only as fast as the project that tests and releases it.
Reality
Anthropic announced a Critical Infrastructure Defense Program that pairs Claude with outside security firms, CrowdStrike among them. Alongside it, Anthropic is running a free, opt-in scanning service for open-source maintainers directly, CyberScoop reported.
Perspective Coverage
9 publishersReality
Anthropic's Cyber Mission puts Claude models, engineers and funding behind bug fixing, after Glasswing finds often waited months for a patch. Its free OSS Scanner sends unreviewed reports that Anthropic expects to be over 90% accurate, so it suits maintainers who have time to verify them.
Reality
Anthropic expects more than 90% of the unreviewed vulnerability reports its new OSS Scanner sends to open source maintainers to be real. Opt-in projects get findings faster and take on the work of catching the errors, such as wrong severity ratings.
Perspective Coverage
6 publishersReality
Nethermind and ZEUS applied for Anthropic's OSS Scanner a day after it launched, asking for AI scans of Ethereum client and Bitcoin wallet code. Anthropic had manually checked about 6,000 of the 29,000-plus flaws its models flagged, crypto.news reported, so the teams that get the reports have to judge them.
Reality
Anthropic has launched OSS Scanner, a free opt-in service that sends open-source maintainers AI vulnerability reports no human has reviewed. The triage Anthropic skips falls to maintainers, so downstream teams should expect more upstream findings that a person still has to confirm.
Reality
Google stopped taking product vulnerability reports for its open-source bug bounty on October 1 after a flood of invalid AI-generated submissions. Any team that takes outside security reports faces the same imbalance, with reports now cheap to write and as costly as ever to check.
Perspective Coverage
15 publishersReality
Microsoft's FORGE lab helped discover Windows flaws assigned 140 CVEs from May to September 2026, 52 of them fixed in the September release. Microsoft says the pace now depends on how fast its response center can validate and fix what the AI agents report.
Reality
LibreOffice 26.2.5 and 26.8.0 fix a flaw that lets a spreadsheet run Java code on open with no warning; Apache OpenOffice's fix waits on 4.1.17. The attack needs Java enabled, so OpenOffice users can block it now by turning Java off.
Reality
Imperva found that a syntactically valid SQL query under 2MB can drive the SQLGlot parser past 1.5GB of memory, about 750 times the input. Tools that parse user or model-supplied SQL before the database sees it carry the same exposure until they upgrade.
Reality
OpenSSF published CRA readiness guidance for manufacturers that have owed 24-hour warnings on exploited vulnerabilities since September 11. Open-source stewards do not start reporting until December 2027, so for 15 months the duty sits with product teams alone.
Reality
Apache Software Foundation teams scanned 230 repositories with Anthropic's Claude Mythos 5 over three days in August 2026. Findings now go to the projects that own the code through the foundation's official disclosure path, and remediation has started.
Reality