All news with #vulnerability management tag

🔍 Amazon Inspector’s SBOM Generator (inspector-sbomgen) now supports a plugin system that lets developers add custom package collectors without recompiling or waiting for official releases. The post explains how to scaffold plugins, the discovery-collection pipeline, testing with Lua fixtures, and IDE support for rapid iteration. It also details the sandboxed safety model, artifact tracing via source_path, and how plugin-generated components integrate with Amazon Inspector for vulnerability scanning.

🔒 Google reports that AI has enabled Chrome to patch 1,072 security bugs across Chrome 149 and 150, exceeding the total fixed in the prior 23 milestones combined. The company uses large language models across the vulnerability lifecycle—from discovery and repro to patch generation and testing—and has developed multi-agent systems like Naptime and Big Sleep. Google is also accelerating updates with tighter release cycles and exploring dynamic patching to reduce the window between fix commit and user update.

🔍 Action1 surveyed over 1,000 sysadmins worldwide to compare 2024 expectations of AI and automation against the state of adoption in 2026. The report finds substantial shortfalls in areas such as patch management, monitoring, vulnerability prioritization and incident remediation, with predicted full automation far exceeding current implementation. Adoption is, however, growing selectively: many admins use AI for analysis and recommendations under supervised models while retaining authority over critical decisions. Concerns remain around privacy, accuracy, cost and job impact.

🔍 VulnCheck's H1 2026 analysis finds that vulnerabilities discovered with AI tools are being exploited in the wild at roughly the same rate as those found without AI. Of 1,061 AI-attributed findings, 14 (1.3%) were confirmed exploited, closely matching the overall exploitation rate for the period. The report also notes that Anthropic's Project Glasswing produced over 23,000 findings but only 126 led to CVEs and one confirmed exploitation. The researcher concludes frontier AI currently appears to help defenders more than attackers.

🛡️ CISA’s Binding Operational Directive (BOD) 26-04 shifts federal vulnerability management from uniform deadlines to risk-based remediation, prioritizing exposures most likely to be exploited. The directive recognizes that CVSS scores alone don’t capture exploitability, reachability or operational context. With AI accelerating attack lifecycles and expanding the attack surface via copilots and integrations, defenders must adopt continuous exposure mapping and validation. The article argues defenders need adversary-aware testing, business-aligned prioritization and a move from patch counts to exposure-centric strategies.

📈 This edition of the Threat Source newsletter reviews Q2 2026 vulnerability trends, noting a 49% YoY increase in tracked CVEs and roughly 200 CVEs per day by June. The author contrasts a shifting AI model landscape with slower real-world impact, highlights concerns about keyword-sensitive AI-CVE counts, and advocates prioritizing patches using EPSS rather than raw CVSS scores. Additional coverage includes Cisco Talos' discovery of the Rust-based msaRAT, new Antares SLMs for vulnerability localization, major incidents impacting land registries and WordPress sites, and tactical detection recommendations.

🛡️ Microsoft advises Windows administrators to apply security patches within three days, arguing that AI has accelerated vulnerability discovery and exploitation. Many enterprise teams, however, say the blanket three-day window is unrealistic given heavy testing, change control, and compatibility constraints. Experts recommend focusing rapid remediation on vulnerabilities with verified exploitation or credible proof-of-concept while using compensating controls and automation to manage broader exposure.

🔎 Cisco introduced the Antares family of open-weight AI models to help security teams quickly locate files likely to contain specific classes of vulnerabilities using CWE descriptions. Rather than detecting CVEs or producing patches, Antares ranks source files and provides an exploration trace to guide human reviewers. Available in 350M, 1B, and 3B parameter sizes, the models are optimized for local deployment and aimed at reducing triage workload without replacing analysts.

🛡️ Eclypsium launched InfraTrust and a monthly InfraTrust Pulse to aggregate vendor infrastructure advisories and guide administrators on which flaws to patch first. The inaugural July 2026 Pulse tracked 61 advisories from 14 vendors, flagging six critical advisories and 26 remotely exploitable, unauthenticated vulnerabilities. The report emphasizes prioritizing flaws by exploitability, exposure, and real-world risk rather than CVSS alone.

🔍 The 2026 Exposure Gap Report finds that while many organizations can identify and prioritize exposures, turning those insights into timely remediation is inconsistent. Some sectors, like Utilities, remediate in roughly 12.6 hours, whereas Healthcare averages about 158 hours. The report highlights that delays often begin before remediation—during validation and ownership assignment—and that connected workflows enable faster, repeatable remediation at scale.

🔒 DeepMind has released Gemini 3.5 Flash Cyber, a lightweight AI specialized in rapid vulnerability discovery, validation, and patching. The model is available only to governments and trusted partners via the CodeMender pilot program and is designed for high-speed, low-cost scanning of code paths. DeepMind reports it outperforms other Gemini variants and rival models in finding unique, confirmed issues across complex projects.

🛡️ The Black Kite Ransomware Report 2026 finds 146 active ransomware groups as of June 2026, up from 105 a year earlier, with 61 new groups emerging in 2026 alone. The study highlights a fragmented ecosystem where groups often have short lifespans—averaging 4.9 months—and a small number of operators still account for a large share of disclosed victims. Black Kite urges organizations to prioritize rapid patching of critical vulnerabilities and strengthen identity and vendor controls to mitigate attacks.

🔐 At a recent Information Security Day seminar, white-hat hacker and Steelion CEO Park Chan-am outlined how AI is accelerating attacks and reshaping security priorities. He emphasized that access control, supply chain security, and human verification remain central even as AI shortens vulnerability discovery from weeks to hours. Park warned that AI agents and local testing environments widen attack surfaces and urged new approaches to vulnerability prioritization and behavioral defenses.

⚠️ This week saw small inputs produce severe outcomes: unauthenticated RCEs in WordPress Core, SonicWall SMA zero-days exploited in the wild, OpenSSL DoS via an 11-byte payload, and a SharePoint RCE added to CISA's KEV catalog. Other notable items include the OkoBot malware framework targeting crypto wallets, the NadMesh botnet harvesting cloud keys, and a long list of high-priority CVEs that require immediate patching and investigation.

🛡️ This piece examines how Anthropic's Mythos accelerated vulnerability discovery but did not create the core problem: the exposure window. It explains that while AI has pushed discovery and prioritization to machine speed, mobilization—the organizational steps to actually fix vulnerabilities—remains slow. The article argues security teams must adopt speed-based metrics and attack-path analysis to reduce the blast radius and convert remediation into a measurable business risk.

🛡️ Anthropic’s Claude Mythos is a frontier AI model optimized for cybersecurity and healthcare, released initially to vetted partners via Project Glasswing to discover vulnerabilities at scale. Partners reported thousands of high-severity findings, prompting restricted access, export-control scrutiny, and the release of a guarded variant, Claude Fable. Vendors and defenders are adapting AI-driven workflows, while critics highlight guardrail limits, false positives, and the need to fix remediation gaps.

🛡️ This article from Mandiant Consulting outlines practical guidance for safely integrating AI agents into vulnerability discovery and remediation workflows. It emphasizes grounding AI adoption in established frameworks such as NIST RMF, OWASP for LLMs, and Google’s SAIF, and prescribes layered defenses including deterministic policy engines, sandboxed agent workloads, zero data retention agreements, and human-led red teaming. The post also stresses threat modeling, least-privileged machine identities, supply chain vigilance for agent skills, and runtime observability to prevent data exfiltration and prompt-injection risks.

🛡️ AI is accelerating offensive security by producing many potential findings quickly, but generated reports are not the same as validated evidence. AI tools can read code, generate payloads, and suggest attack paths, yet validation still requires human knowledge of systems, reachability, and exploitability. Low-quality AI submissions are already increasing triage burden, so teams must separate leads from proven findings and apply rigorous validation before driving engineering action.

🛡️ The US government has launched Gold Eagle, a program led by CISA, the Treasury and the Department of Defense to speed detection and remediation of software vulnerabilities. The initiative, previewed in Executive Order 14409, aims to centralize reporting and reduce duplicate scans, likely using the VINCE platform with public-private participation. Experts warn the plan may not address the core remediation capacity and coordination issues that limit patch deployment.

🔍 Security experts urge enterprises to shift from scheduled patch cycles to risk-based, continuous approaches such as just-in-time patching, citing AI-driven vulnerability discovery and exploitation that outpace traditional models. Vendors warn that AI tools can rapidly surface and validate flaws, widening the gap between discovery and remediation and overwhelming teams. Compensating controls like virtual patching can help, but they are stopgaps; organizations need continuous asset visibility, real-time exploitation intelligence, and prioritization based on exposure and exploitability.