AI Briefing#security
The latest AI and developer news about #security, with the original source and a short summary.
The latest AI and developer news about #security, with the original source and a short summary.
To prevent privilege abuse by coding agents, security boundaries must be separated by component.
skills.sh, a context package manager for agents, has surpassed 69,000 skills, addressing agents' knowledge gaps.
Vercel automatically blocks new deployments that include the next-mdx-remote package affected by the CVE-2026-0969 vulnerability.
Vercel has introduced a new token format to enhance security and launched a feature that automatically invalidates credentials through GitHub secret scanning.
What matters isn't the agent's memory, but reconstructable context.
A DoS vulnerability has been discovered in React Server Components that causes server crashes and CPU overload, prompting recommendations for immediate updates.
Two DoS vulnerabilities causing memory exhaustion have been discovered in self-hosted Next.js applications.
Vercel now supports multiple Protection Bypass for Automation secrets, making secret rotation and workflow management easier.
Vercel now lets teams specify a default Deployment Protection setting that will be applied to new projects.
This introduces a case study of how Kakao manages its corporate attack surface through **YEYE**.
Since the page content is not exposed, only a 404 status is confirmed instead of the actual body text.
Support for mysql_native_password is discontinued in MySQL 9.0, making the transition to caching_sha2_password and preparation for SSL/RSA connections essential.
OpenAI has announced an 'Outbound Coordinated Vulnerability Disclosure Policy' for responsibly reporting vulnerabilities in third-party software discovered through AI.
Replit has unveiled 'Replit Auth,' which lets developers implement secure login and user management with a single prompt.
Kakao has unveiled a security and privacy protection system that applies Privacy by Design principles to prevent privacy infringements from the service planning stage and enhances expertise by separating the roles of the CPO and CISO.
A Zip Bomb error that occurred during Excel file upload was resolved by relaxing Apache POI's compression ratio check threshold.
Kakaopay introduces how it manages code quality and security in a DevSecOps environment using Sonarqube.
Hugging Face has partnered with TruffleHog to introduce scanning that prevents API key and token leaks within repositories.
Hugging Face summarized key security features—including fine-grained permission tokens, 2FA, and commit signing—designed to protect Hub users' assets.
OpenAI's board has formed a dedicated committee to make safety and security decisions for its next-generation model.
OpenAI has launched new enterprise-grade API features for security, administrative controls, Assistants API improvements, and cost savings.
Properly setting the level, format, and permissions of error and access logs keeps both security and operations healthy.
To strengthen security, Hugging Face is discontinuing password authentication for Git and requiring the use of tokens or SSH keys instead.
A guide to basic security measures for Linux servers, including checking DNS configuration file permissions and securing BIND Zone Transfer settings.