News reporting focused on AI and machine learning, covering the companies behind these technologies, their real-world applications, and the ethical concerns they raise. This includes areas like generative AI (large language models, text-to-image and video), speech tech, and predictive analytics.
The curl project faces unprecedented pressure from a surge in AI-assisted security vulnerability reports. Maintainer Daniel Stenberg reports the rate of incoming security reports is 4-5 times higher than in 2024, with more than one report per day. Despite the flood, most vulnerabilities found are low or medium severity, with the last high-severity CVE in October 2023.
A vulnerability in the Starlette open source framework, which gets 325 million weekly downloads, puts millions of AI agents at risk. Tracked as CVE-2026-48710 and named BadHost, the flaw lets attackers bypass path-based authorization via a single character in the HTTP Host header. Affected packages include FastAPI, vLLM, and LiteLLM, and exploitation can expose sensitive data like clinical trial databases, email credentials, and cloud infrastructure details.
Apple released macOS Tahoe 26.5, addressing numerous security vulnerabilities including a kernel bug (CVE-2026-28952) discovered by Calif.io in collaboration with Claude and Anthropic. The update fixes issues from denial-of-service to privilege escalation, sandbox escapes, and memory corruption. Multiple researchers and organizations are credited.
A detailed lab test shows how CVE-2026-31431, known as Copy Fail, escalates privileges inside rootless Podman containers but fails to escape to the host due to user namespace mappings. The analysis covers shellcode disassembly, exploit tracing, and kernel behavior via eBPF. Rootless setups on GNOME GitLab runners contain the issue effectively.
Researchers from Theori released exploit code for CVE-2026-31431, known as CopyFail, a serious local privilege escalation flaw affecting most Linux releases. The single Python script works across distributions like Ubuntu 22.04, Amazon Linux 2023, SUSE 15.6, and Debian 12, threatening multi-tenant servers, Kubernetes containers, and CI/CD pipelines. Kernel patches exist for versions including 7.0, 6.19.12, and others, but many distributions lack updates, prompting urgent checks.