#Open Source
All CosmicBytez Labs articles tagged #Open Source, across news, security advisories, how-to guides, and projects.
- News
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
GhostAction hijacked pyxel's and Uber athenadriver's maintainer accounts, pushing credential-stealing workflows to hundreds of repos in a 500-account wave.
- News
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
The MALFEX campaign hid a Solana-C2 RAT and a credential stealer in npm postinstall hooks; three of the eight packages are still live.
- News
Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports
Google paused payouts for OSS VRP product bug reports on October 1 after a surge in automated submissions, most of them invalid, flooded Go, Angular, and Bazel.
- News
Google Halts Open Source Bug Bounty Program Amid AI Spam Surge
Google paused OSS VRP product submissions on October 1 after AI-generated reports buried reviewers, joining curl and Intel in scaling back bounties.
- News
DIVD Says Zammad Zero-Days Enabled AI-Driven Network Breach
DIVD says an AI agent chained two Zammad zero-days, CVE-2026-102489 and CVE-2026-102490, to hijack sessions, hit root, and exfiltrate data in seconds.
- Security
CVE-2026-90566: Privilege Escalation via Unvalidated usertype in inventory-management-system
A CVSS 7.3 flaw in Rizwan17's inventory-management-system lets attackers set a privileged usertype during registration, escalating to admin access.
- News
Chainguard Surpasses 1 Billion Container Build Manifests With Factory 2.0
Chainguard doubled its build volume to over 1 billion manifests in six months, powered by an automated factory rebuilding images at scale.
- News
Shipping More AI Code Than You Can Secure: The Remediation Debt Crisis
AI coding tools introduce open-source dependencies faster than security teams can review them, creating remediation debt that scales with AI autonomy.
- Security
CVE-2026-71485: Critical Header Injection in Centrifugo Real-Time Messaging Server
Centrifugo before 6.9.0 propagates client-controlled ConnectRequest headers into internal context without sanitization, scoring CVSS 9.1 Critical.
- News
Who Vets AI's Code? The Scale Challenge Facing Open Source Ingestion
With 85% of enterprises using AI coding tools but only 9% deploying AI-specific security controls, open source ingestion faces a critical vetting gap.
- News
Growing Up The Hard Way: Open Source Security's Painful Maturation
Chainguard's essay argues that open source software has been forced into an overdue adulthood — from XZ Utils to the EU Cyber Resilience Act — and what...
- News
Arch Linux Disables AUR Package Adoption to Stop Malware Flood
Arch Linux has temporarily disabled the adoption of orphaned AUR packages after a wave of malicious takeovers — attackers claimed unmaintained packages...
- News
North Korean Hackers Behind Major Open-Source Supply Chain Attacks, Amazon Says
Amazon security research has exposed a North Korea-linked hacker group as the orchestrators of multiple high-profile open-source software supply chain...
- News
New GitHub, PyPI Policies Boost Supply Chain Security
Dependabot gets a three-day cooldown window before opening pull requests, and PyPI now rejects file uploads to releases older than 14 days—two targeted...
- News
Microsoft, Tech Companies Throw Weight Behind Spread of Open-Source AI
Microsoft, Meta, NVIDIA, IBM, Palantir, Perplexity, Mistral, Mozilla, The Linux Foundation, Hugging Face, and Dell Technologies have co-signed a letter...
- News
Turning the Tables on Email Scammers With 'ScamBuster'
An open-source, AI-driven system called ScamBuster adopts victim personas to actively engage with phishing attackers — gathering intelligence on criminal...
- News
North Korean Hackers Target Open Source Developers in Supply Chain Attacks
The PolinRider campaign has compromised more than 100 legitimate open source packages and repositories to deliver a backdoor and information stealer...
- News
Flipper Zero Firmware Development Continues With Community Help
Flipper Devices is downsizing its internal development team but confirms that Flipper Zero firmware development will continue, with greater reliance on...
- News
In Other News: Canadian Hacker Jailed, Open Source Zero-Days, Two Sentenced for ATM Jackpotting
A roundup of security stories you may have missed: an Anonymous-linked Canadian hacker receives a prison sentence, a researcher drops zero-days in open...
- News
Anthropic's AI Finds Bugs. IBM Bets $5B It Can Fix Them.
IBM and Red Hat announced Project Lightwell — a $5 billion commitment to secure open-source supply chains using Anthropic's Mythos AI model, which found...
- Project
OWASP DefectDojo: Self-Hosted Vulnerability Management Platform
Aggregate, deduplicate, and track security findings from 100+ scanners in a unified dashboard. Build a production-grade vulnerability management pipeline...
- News
Decades-Old Bash Tricks Expose AI Coding Agents to Supply Chain Attacks
Security researchers have found that classic Bash shell techniques — some dating back decades — can bypass the safeguards in most open-source AI coding...
- News
Linux Foundation Unveils New Open Source Security Project Akrites
The Linux Foundation has launched Akrites, a new open source security initiative designed to give the community standardized tools and channels to report,...
- News
New Initiative Tackles Security for End-of-Life Open Source Software
The Open Source Sustainability Initiative launches to help enterprises manage and secure aging open source projects, addressing the growing compliance and...
- News
25-Year-Old Vulnerability Patched in Curl
Curl 8.21.0 patches 18 vulnerabilities including a 25-year-old mTLS connection reuse flaw (CVE-2026-8932) that could allow authentication bypass. With...
- News
Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking
Security researchers have disclosed a class of exploitable flaws in CI/CD pipeline configurations that allow unauthenticated attackers to take full...
- News
How Software Development's Speed Obsession Enabled TeamPCP's Chaos Crusade
TeamPCP's remarkable success attacking open-source software was no accident — it exploited a cultural vulnerability baked into modern development: the...
- Project
Building a SOAR Platform with Shuffle in Your Homelab
Deploy Shuffle, the open-source SOAR platform, to automate security workflows and orchestrate your homelab tools — from Wazuh alerts to enrichment lookups...
- News
OWASP Incubator Project Helps Developers Find and Fix Vulnerable Dependencies in Seconds
OWASP has launched CVE Lite CLI, a free open-source command line tool that scans software projects in seconds to identify packages with known CVE…
- News
EU Unveils Tech Sovereignty Package to Cut Reliance on US and Chinese Suppliers
The European Commission has unveiled a sweeping technology sovereignty package combining a Chips Act 2.0, a Cloud and AI Development Act (CADA), an Open…
- News
Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS
Researchers have uncovered a large-scale SEO poisoning campaign that uses fake open-source and freeware project sites to funnel victims through a Traffic…
- News
IBM and Red Hat Commit $5 Billion to Secure Open Source Supply Chains Under "Project Lightwell"
IBM and Red Hat unveil Project Lightwell, a $5B commitment to securing open-source supply chains by fixing vulnerabilities without breaking production.
- News
Apple Open-Sources Quantum-Resistant Encryption Code
Apple has open-sourced its implementations of two NIST-standardized quantum-secure algorithms — ML-KEM and ML-DSA — including formal verification tooling that.
- News
CrowdStrike Dismantles Glassworm Botnet Targeting Open-Source Supply Chain
CrowdStrike, Google, and Shadowserver dismantled the Glassworm botnet, stripping operators of infrastructure used to inject malware into OSS packages.
- News
Gitea Vulnerability Exposes Private Container Images without Authentication
A Gitea flaw lets unauthenticated remote attackers pull private container images from self-hosted deployments with no account or credentials required.
- News
GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure
CrowdStrike, Google, and Shadowserver simultaneously disrupted GlassWorm C2 channels, ending a supply-chain campaign targeting developers via packages.
- News
Open Source DockSec Uses AI to Cut Through Vulnerability
DockSec, an OWASP incubator project, combines multiple container security scanners with AI-generated plain-English remediation guidance and exact Dockerfile.
- News
The Hackers Behind Shai-Hulud: Lucky or Skilled?
TeamPCP's Shai-Hulud worm inflicted serious damage on the open source ecosystem — but a close look at their operations raises the question of whether their.
- News
npm Adds 2FA-Gated Publishing and Package Install Controls
GitHub has rolled out new security controls for npm including staged publishing with 2FA approval requirements and package install policies, giving...
- News
Socket Raises $60 Million at $1 Billion Valuation
Supply chain security startup Socket has raised $60 million in a new funding round, valuing the company at $1 billion. The capital will expand Socket's...
- News
Shai-Hulud Worm Clones Spread After Code Release
The public release of the Shai-Hulud worm source code by TeamPCP has triggered a wave of copycat variants appearing across the npm ecosystem. Security...
- News
PraisonAI CVE-2026-44338 Auth Bypass Targeted Within Hours
Threat actors began exploiting CVE-2026-44338, a missing authentication flaw in the PraisonAI multi-agent orchestration framework, within just four hours...
- News
Worm Redux: Fresh Mini Shai-Hulud Infections Bite npm
Hundreds of npm packages in the TanStack open source ecosystem have been infected by a fresh wave of Mini Shai-Hulud worm activity from TeamPCP — the same...
- News
JDownloader Site Hacked to Replace Installers with Python
The official website for JDownloader, one of the most widely-used open-source download managers, was compromised to distribute malicious Windows and Linux...
- News
Cisco Releases Open Source Tool for AI Model Provenance
Cisco has released a new open source toolkit designed to track and verify the provenance of AI models throughout the supply chain, addressing risks from...
- News
Hackers Exploit RCE Flaws in Qinglong Task Scheduler for Cryptomining
Threat actors are actively exploiting two authentication bypass vulnerabilities in the Qinglong open-source task scheduling tool to deploy cryptomining...
- Security
CVE-2026-41478: Saltcorn SQL Injection Allows Full Database
A critical SQL injection vulnerability in Saltcorn's mobile-sync routes allows any authenticated low-privilege user with read access to a single table to...
- Security
CVE-2026-33656: EspoCRM Formula Engine Attachment sourceId
A critical improper access control vulnerability in EspoCRM's built-in formula scripting engine allows authenticated administrators to overwrite the...
- Security
CVE-2026-39987: Marimo Pre-Auth Remote Code Execution
A critical pre-authorization remote code execution vulnerability in Marimo, the open-source reactive Python notebook, allows unauthenticated attackers to...
- Security
CVE-2026-41167: Jellystat Authenticated SQL Injection in Multiple API Endpoints (CVSS 9.1)
A critical SQL injection vulnerability in Jellystat, the open-source statistics app for Jellyfin, allows authenticated users to execute arbitrary SQL...
- Security
CVE-2026-41228 — Froxlor Path Traversal via def_language
A critical path traversal vulnerability in Froxlor's Customers.update and Admins.update API endpoints allows authenticated low-privilege users to traverse...
- Security
CVE-2026-41229 — Froxlor PHP Code Injection via MySQL
A critical PHP code injection vulnerability in Froxlor allows an admin with change_serversettings permission to inject arbitrary PHP code via unescaped...
- Security
CVE-2026-40259 — SiYuan Knowledge Management Authorization
A high-severity authorization bypass in SiYuan versions 3.6.3 and below allows attackers with RoleReader publish-service tokens to call a privileged...
- News
Microsoft Suspends Dev Accounts for High-Profile Open
Microsoft has suspended developer accounts used to maintain several prominent open-source projects without prior notice or a quick reinstatement path,...
- News
Chainguard Unveils Factory 2.0 to Automate Hardening the Software Supply Chain
The rebuilt Chainguard Factory platform adds deeper security automation designed to continuously reconcile open source artifacts across containers,...
- News
Claude Code Source Code Accidentally Leaked in NPM Package
Anthropic accidentally published the source code for Claude Code — its normally closed-source AI coding assistant — inside an npm package. The company...
- Security
CVE-2026-33478: AVideo CloneSite Plugin Unauthenticated RCE
A critical chain of vulnerabilities in WWBN AVideo's CloneSite plugin allows fully unauthenticated attackers to achieve remote code execution via key...
- News
Betterleaks: New Open-Source Secrets Scanner Built to Replace Gitleaks
Betterleaks is a new open-source tool that scans directories, files, and git repositories for valid secrets — and validates them against live APIs before...
- HOWTO
How to Deploy Wazuh SIEM/XDR for Unified Security Monitoring
Step-by-step guide to deploying Wazuh as an open-source SIEM and XDR platform. Covers server installation, agent deployment across Windows and Linux,...
- News
Cline CLI Supply Chain Attack Installs Unauthorized
A compromised npm publish token was used to inject a malicious postinstall script into Cline CLI version 2.3.0 on February 17, 2026, silently installing...
- Project
Build Your Own SIEM with Open-Source Tools
Step-by-step project guide for building a functional SIEM using Wazuh, Elastic, and Grafana. Perfect for homelabs and small businesses.
- News
Supply Chain Attack Discovered in Popular NPM Packages
Security researchers have discovered malicious code injected into several popular NPM packages with millions of weekly downloads. Developers urged to...