TAG
#appsec
Stories connected through a shared idea, actor, technology or theme.
CodeQL 2.26.4 expands language and GitHub Actions security coverageGitHub rolled CodeQL 2.26.4 into code scanning on github.com with Go 1.27 support, more precise Rust data-flow locations, new Spring R2DBC SQL-injection sinks and expanded Java, Kotlin, JavaScript, TypeScript and Python taint modelling. The release also adds GitHub Actions detections for mutable references to reusable workflows and improves checks on workflow actor fields.→Cycode releases agentic code scanning and attack-path chainingCycode said its Agentic Code Scanning combines rule-based and agentic analysis, while its benchmark testing found two authorisation CVEs that rule engines could not express. Its new Attack Chaining capability links related findings into multi-step exploit paths.→SonarQube Hunter Agent adds reasoning-based security analysisSonar launched Hunter Agent for SonarQube Cloud to analyse broken access control, business-logic, authentication and session-management flaws. The agent traces code, data and identity flows across a codebase and verifies candidate findings before presenting them in the existing Sonar workflow.→PaperCut releases an emergency patch after confirmed exploitationPaperCut's security bulletin recorded confirmed exploitation and customer incidents affecting all NG and MF versions, then announced an emergency patch for versions 25 and 26 at 02:10 AEST. The company advised restricting public access to affected servers while work continued on the version 24 patch.→Nucleus Helix combines vulnerability intelligence with agentic exposure workflowsNucleus said Helix adds passive early-warning discovery before scanner signatures are available, a natural-language AI agent and expanded data-collection and remediation guidance. The platform is grounded in Nucleus's asset, software, ownership and exposure data.→