🤖 The “AI Vulnerability Storm”: Building a “Mythos-ready” Security Program

AI, as demonstrated by Anthropic's Mythos, has significantly increased the likelihood of attackers discovering new vulnerabilities, creating new exploits, and using them in complex automated attacks at scale. While AI also increases the speed of patch development and reduces defects in new software, defenders still face a heavier relative burden due to the inherent limitations of patching. Attackers gain asymmetric benefits.

#AI

👨‍💻 GitHub Actions Security Pt 1: Attacks & Defenses

Part one of a two-part series on GitHub Actions security, covering the core threat model, common misconfigurations, and real-world attack examples.

https://www.wiz.io/blog/github-actions-security-threat-model-and-defenses

#github

🔐 Passkeys are Your New Best Friend

A lightweight intro to passkeys from Google.

https://bughunters.google.com/blog/passkeys-are-your-new-best-friend

#iam

🤖 How Amazon uses agentic AI for vulnerability detection at global scale

Amazon's RuleForge is a multi-agent AI system that auto-generates CVE detection rules from exploit PoC code. It uses parallel generation (via Amazon Bedrock/Fargate), a separate judge model (reducing false positives by 67%), and multistage validation, achieving 336% faster rule production than manual workflows while keeping humans in the final approval loop.

https://www.amazon.science/blog/how-amazon-uses-agentic-ai-for-vulnerability-detection-at-global-scale

#AI

🌩 My Claude Code Setup (2026 Edition)

A walkthrough of my Claude Code setup across a multi-project monorepo: global settings, safety guardrails, a context/plan/code workflow, subagents and plugins, and the StarCraft-themed customisations that make the terminal feel like mine.

https://blog.marcolancini.it/2026/blog-my-claude-code-setup

#ClaudeCode

🤖 magika

Fast and accurate AI powered file content types detection.

https://github.com/google/magika

#AI

🤖 redai

AI-driven vulnerability discovery and live validation.

https://github.com/kpolley/redai

#AI

👨‍💻 GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

Wiz Research discovered CVE-2026-3854 (CVSS 8.7): an unsanitized semicolon injection in GitHub's X-Stat internal header allows any authenticated user to override security fields via git push -o, achieving RCE on GitHub com and full GHES server compromise.

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

#github

🤖 OpenShell

OpenShell is the safe, private runtime for autonomous AI agents.

https://github.com/NVIDIA/OpenShell

#AI

🖥 Proof, Not Promises: Evaluating Code Scanner Efficacy

How Block built benchmrk, a harness for measuring SAST scanner efficacy against ground truth you control.

https://engineering.block.xyz/blog/proof-not-promises-evaluating-code-scanner-efficacy

#SAST