VMs, containers, V8 isolates, WASM and agent sandboxes all promise containment. Here's what each one really stops, what it costs, and where it leaks.

I found a flaw in brig where an agent inside the sandbox plants a symlink resulting in an arbitrary host directory with read-write abilities in and out of the sandbox. Tracked as GHSA-wp6x-29qx-fpr7 ...

Nine days after GPT-6 Sol, Codex with GPT-6.1 Sol scores 77.7% FuncPass and 34.1% SecPass — within one task of GPT-6 Astra on security, a third faster, and with zero confirmed cheating.

A capable frontier model isn’t a controlled system. Here are seven questions security teams should answer before they trust AI coding agents with consequential work.

From September 11th, if a vulnerability in a product you sell into the EU is being actively exploited, you have 24 hours to tell a regulator about it. That is the part of the EU Cyber Resilience Act ...

jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic ...

https://github.com/Serotav/Writeups/blob/77556c57999805fa7815a114da51d91cf24fbea9/v8/WhenSortingLeadsToConfusion.md https://issues.chromium.org/issues/542403045 https ...

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle ...

Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Use after free in WebGL in Google ...

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. Improper Neutralization of Special ...

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crush_decode CRUSH bucket type 0 is reserved for devices. In the Linux kernel, the following ...