AI-supported vulnerability triage with the GitHub Security Lab Taskflow Agent

Triaging security alerts is often very repetitive because false positives are caused by patterns that are obvious to a human auditor but difficult to encode as a formal code pattern. But large language models LLMs excel at matching the fuzzy patterns that traditional tools struggle with, so we at...

Spring AI Agentic Patterns (Part 3): Why Your AI Agent Forgets Tasks (And How to Fix It)

Have you ever asked an AI agent to perform a complex multi-step task, only to find it skipped a critical step halfway through? You're not alone. Research shows that LLMs struggle with "lost in the middle" failures—forgetting tasks buried in long contexts. When your agent juggles file edits, test...

LLM Security and Safety: Insights from Homotopy-Inspired Prompt Obfuscation

In this study, we propose a homotopy-inspired prompt obfuscation framework to enhance understanding of security and safety vulnerabilities in Large Language Models LLMs. By systematically applying carefully engineered prompts, we demonstrate how latent model behaviors can be influenced in...

Holmes: An Evidence-Grounded LLM Agent for Auditable DDoS Investigation in Cloud Networks

Cloud environments face frequent DDoS threats due to centralized resources and broad attack surfaces. Modern cloud-native DDoS attacks further evolve rapidly and often blend multi-vector strategies, creating an operational dilemma: defenders need wire-speed monitoring while also requiring...

VulnResolver: A Hybrid Agent Framework for LLM-Based Automated Vulnerability Issue Resolution

As software systems grow in complexity, security vulnerabilities have become increasingly prevalent, posing serious risks and economic costs. Although automated detection tools such as fuzzers have advanced considerably, effective resolution still often depends on human expertise. Existing...

CVE-2025-65368

SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting XSS via user input and LLM output...

CVE-2025-65368

SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting XSS via user input and LLM output...

PT-2026-3106

Name of the Vulnerable Software and Affected Versions SparkyFitness version 0.15.8.2 Description SparkyFitness is susceptible to Cross-Site Scripting XSS attacks. The issue stems from improper handling of user input and output from Large Language Models LLMs. This allows for the injection of...

CVE-2025-65368

SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting XSS via user input and LLM output...

CVE-2025-65368

SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting XSS via user input and LLM output...

AJAR: Adaptive Jailbreak Architecture for Red-Teaming

As Large Language Models LLMs evolve from static chatbots into autonomous agents capable of tool execution, the landscape of AI safety is shifting from content moderation to action security. However, existing red-teaming frameworks remain bifurcated: they either focus on rigid, script-based text...

EUVD-2026-2708

SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting XSS via user input and LLM output...

CVE-2025-65368

SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting XSS via user input and LLM output...

SparkyFitness security vulnerability

SparkyFitness is a fitness and health management platform developed by CodeWithCJ. Version SparkyFitness v0.15.8.2 contains a security vulnerability, which stems from improper handling of user input and LLM outputs, potentially leading to cross-site scripting attacks...

CVE-2025-65368

SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting XSS via user input and LLM output...

EUVD-2026-1865

vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions...

Integrating APK Image and Text Data for Enhanced Threat Detection: A Multimodal Deep Learning Approach to Android Malware

As zero-day Android malware attacks grow more sophisticated, recent research highlights the effectiveness of using image-based representations of malware bytecode to detect previously unseen threats. However, existing studies often overlook how image type and resolution affect detection and ignor...

opencode 安全漏洞

opencode is an AI programming intelligence open-sourced by Anomaly. A security vulnerability exists in versions prior to opencode 1.1.10, which stems from the Markdown renderer not cleaning up the LLM response, and could lead to the execution of JavaScript via HTML injection...

PYSEC-2026-143

vLLM is an inference and serving engine for large language models LLMs. In versions from 0.6.4 to before 0.12.0, users can crash the vLLM engine serving multimodal models that use the Idefics3 vision model implementation by sending a specially crafted 1x1 pixel image. This causes a tensor dimensi...

PYSEC-2026-143

vLLM is an inference and serving engine for large language models LLMs. In versions from 0.6.4 to before 0.12.0, users can crash the vLLM engine serving multimodal models that use the Idefics3 vision model implementation by sending a specially crafted 1x1 pixel image. This causes a tensor dimensi...