CNN, MS NOW and Politico Escalate Legal Battle for White House Access  (Erik Wemple, New York Times)
The news outlets argued in an updated lawsuit that they should be granted access to the White House reporting pools.

read more

After Landing in Miami, Flávio Bolsonaro Heads into Uncertain Political Future  (Alex DeLuca, Terrence McCoy, Sammy Westfall and Marina Dias, Washington Post)
The defeated Brazilian presidential candidate arrived in the U.S. after defying a judicial order to surrender his passports.

read more

The supply chain attack campaign's shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit.

The White House Council of Economic Advisers (CEA)—the president’s in-house think tank—released a reportthis month that purported to find that the average illegal immigrant imposes a lifetime cost on taxpayers of $166,716—or up to $1.9 trillion in total—and that “amnesty” would add to these costs, while deportation spending would cut the deficit.

read more

Reporting Highlights

●  Hidden Hand:Conservative attorney Cleta Mitchell has shaped virtually every aspect of the Trump administration’s norm-busting agenda on American elections. 

●  Movement Builder:After working to overturn Trump’s 2020 defeat, Mitchell forged a national grassroots movement to overhaul voting. Some of her allies now hold top administration jobs. 

read more

The U.S. Department of Justice plans to send election monitors to every state ahead of Election Day, expanding a long-standing practice that’s spurred concern this year among Democrats and voting rights advocates because of President Donald Trump’s push to influence elections.

read more

Swiss ambassador Sabrina Dallafior, the newly elected director-general of the Organization for the Prohibition of Chemical Weapons (OPCW), traveled to Damascusin mid-October. As the head of the international organization charged with implementing the Chemical Weapons Convention (CWC) that bans chemical weapons, her visit marked Syria’s progress in closing the book on the nation’s decades-long chemical weapons program.

read more

As artificial intelligence technologies grow ever more powerful, so do the risks they pose and with them the urgency of regulating AI.

read more

Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to using Nefilim ransomware in attacks.

The post Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison appeared first on SecurityWeek.

The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.

Discover how Cisco Live Protect, virtual patching, and Secure Workload help defenders reduce vulnerability exposure while buying time for critical patches.

Hackers targeted the US Federal Election Commission, emphasizing that election security shouldn’t start and end with voting machines. 

The massive funding round comes just days after reports emerged that Upwind had attracted acquisition interest from several companies, including Datadog

The post Upwind Security Raises $400 Million at $3.8 Billion Valuation appeared first on SecurityWeek.

The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches.

The post Chrome and Firefox Updates Patch Over 200 Vulnerabilities appeared first on SecurityWeek.

Listen to Assistant Secretary Todd Wilcox, who serves as Public Sector Chair at OSAC, talk about his career, the value of OSAC, and trends in the industry.

FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers.

The post TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices appeared first on SecurityWeek.

The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization.

The post China-Linked Hackers Exploit PHP2Shell to Root Firewalls appeared first on SecurityWeek.

Application security vendor Black Duck has launched Signal Agentic Fix, a new AI agent designed to shrink the gap between vulnerability discovery and a validated fix reaching production.

The agent is the latest addition to Black Duck Signal, the company’s collection of AI agents aimed at removing the human workflow bottlenecks that stop security teams keeping pace with the rising volume of vulnerabilities and exploits.

Black Duck says the launch responds to two pressures that AI has intensified for defenders. The first is a swelling remediation backlog, fuelled by the surge in AI-generated code, the higher vulnerability rates found in that code, and a steady flood of new supply chain CVEs. The second is a collapsing time to exploit: attackers are now using AI to chain and weaponise vulnerabilities in hours, while human-led remediation is still typically measured in days or weeks.

Scan, triage, fix, validate, submit

Signal Agentic Fix automates the full remediation loop:

• Scan: Black Duck’s deterministic SAST and SCA engines – the same ones behind Polaris, Coverity and Black Duck SCA – identify defects in proprietary code and open source dependencies.
• Triage: AI assesses severity, reachability and exploitability, filtering out false positives and prioritising the highest-risk issues.
• Fix: AI generates code fixes for SAST findings, while SCA findings receive dependency upgrade fixes based on Black Duck Security Advisories, informed by the company’s ContextAI knowledge base.
• Validate: Fixed code is re-scanned and can optionally be run against customer-defined compliance checks and functional tests to confirm no new defects have been introduced.
• Submit: Every change is routed to a human for review, either via the developer’s AI coding agent or as a pull request in source control.

“The differentiator is not that AI can write a fix; it’s whether you can trust it,” said Dipto Chakravarty, Chief Product & Technology Officer at Black Duck. “A harness that pairs deterministic static and software composition analysis with AI-powered triage, fix generation, and validation, plus human-defined guardrails and approval gates is what makes agentic remediation something enterprises can actually trust and deploy.”

Two deployment models

The agent can work as a security collaborator alongside a developer and their AI coding agent, such as Claude Code. In this mode, Signal Agentic Fix runs the scans and triage, passes findings and fix guidance to the coding agent to implement, then re-scans to validate the result. Because the coding agent makes the change, it is governed by the same hooks and skills a team already uses for code generation.

Alternatively, it can sit in the DevOps pipeline, triggering the remediation loop on commits, builds or on demand, generating fixes with a configured LLM and submitting them as pull requests for team approval.

For organisations in regulated and safety-critical sectors, Black Duck has built in configurable remediation rules governing what the agent may fix and how, validation rules that let teams apply their own coding and compliance standards and test suites, and mandatory human-in-the-loop approval before anything is merged.

Availability

Signal Agentic Fix for Claude Code is available in Early Access now, with further coding agent and DevOps pipeline integrations across Polaris, Coverity and Black Duck SCA due in the coming weeks.

The post Black Duck launches AI agent to fix vulnerabilities as fast as attackers exploit them appeared first on IT Security Guru.

Four EPICS Base flaws found by an autonomous system could let attackers crash processes at particle accelerators and fusion labs.

The post Long-Hidden Flaws Patched in EPICS Research Facility Control Software appeared first on SecurityWeek.

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.

The post Nobody Trusts the Security Questionnaire. We Rely on It Anyway. appeared first on SecurityWeek.