Seal Security raises $13 million in Series A funding to secure open source code at scale with vulnerability-free open source components.
Bank of America added 1,000 contractors to patch flaws found by AI models. AI that validates and backports the fixes can clear the same queue without headcount.
A cooldown blocks the new fix and a CVE policy blocks the version you run. Why AI-found vulnerabilities make this deadlock common, and how to break it.
A heap overflow in Jansi's JNI ioctl() wrapper lets a short int[] overwrite the native heap. CVE-2026-8484 affects every release, and Jansi is unmaintained.
CVE-2023-40743 turns Apache Axis 1.4's ServiceFactory into a JNDI injection RCE. There is no fixed release, and the upstream fix took three commits.
Abandoned packages don’t get CVEs, so your scanner calls them clean. extract-zip sat on a public arbitrary file write for years. We assigned CVE-2026-19693.
Compare the four options for open source vulnerability remediation, price the real cost of doing nothing, and build a business case your execs will approve.
A 38-byte ZIP can hang any service that unzips untrusted files with fflate 0.4.5 to 0.8.2. Fixed in 0.8.3, plus a patch if you can't upgrade.
Seal Security found an OSC-8 ANSI escape injection in vercel-labs' skills CLI: a malicious skill can rewrite terminal output and forge clickable links.
CVE-2026-13149: a crafted pattern can hang brace-expansion, the npm package behind eslint, glob and minimatch. Who's affected and how to fix it transitively.
The vercel-labs skills CLI (1M+ weekly downloads) can be tricked into replacing a trusted agent skill via Unicode homoglyphs. How it works, how to stay safe.
The best AI rollout is the one nobody noticed. Here's how Seal shipped three AI workflows with zero new tools to open, zero training, and zero behavior change.
Go beyond build-time blocking: neutralize malicious package versions across pipelines and production, without breaking CI/CD or slowing delivery.
%20copy.jpg)
