TAG
#application security
Stories connected through a shared idea, actor, technology or theme.
Submersion AI launches Basin cybersecurity reasoning modelThe company reports an 80.8% CyberGym score and an eighth-place launch ranking. Basin has also been credited with discovering vulnerabilities in Snipe-IT and BookStack.→CogniCrypt applies concolic execution and LLM-guided analysis to AI-generated malwareThe company said CogniCrypt combines concolic execution, LLM-guided analysis and deep learning to analyse unfamiliar software. Quandary Peak is incorporating it into M&A assessments and described the underlying work as accepted at the CRIS 2026 conference.→PocketBase v0.40.0 hardens defaults and backend operationsThe release enables a same-origin Cross-Origin-Opener-Policy header by default, adds log deletion, caps log payload sizes, and avoids transaction locking during backups. It also enables SQLite defensive mode, updates modernc SQLite, raises the minimum Go version to 1.27, and migrates to encoding/json/v2.→GitHub adds organisation-level Code Quality trendsThe dashboard now plots open findings over 7-, 14-, or 30-day periods and ranks repositories by changes. It respects existing filters and is available to eligible GitHub Enterprise Cloud and Team organisations using Code Quality, but not GitHub Enterprise Server.→Researchers show how Copilot can be induced to expose connected dataThe CoSnitch research found that repeatedly challenging Microsoft Copilot about an attack could reveal undocumented autorun and prompt-parameter behaviour. A crafted URL could then execute a malicious prompt in an authenticated session, potentially exposing connected application data or altering Copilot memory.→Rapid7 says AI is compressing the vulnerability-to-exploitation cycleRapid7 reported that high- and critical-severity vulnerability disclosures doubled year on year to 8,539 in Q2 2026, while newly exploited vulnerabilities rose 8% to 40. The analysis links the pressure to AI-assisted discovery and exploitation, as well as insecure code produced through vibe coding, and recommends prioritising exposure over severity scores alone.→