Java

Frame is a new neuro-symbolic SAST tool designed to bridge the gap between precise but narrow symbolic analyzers and broad but ungrounded LLM scanners. By using a symbolic engine to verify LLM-proposed vulnerabilities, it achieves higher recall without sacrificing precision.

Cybersecurity researchers have identified a sophisticated campaign where Sandworm-linked actors exploit Cisco FMC vulnerabilities to deploy Cyclops Blink malware. This updated malware variant features enhanced reconnaissance capabilities and targets 64-bit Linux-based network appliances.

This article details a highly technical experiment where an LLM-driven agent was used to automate the discovery and exploitation of vulnerabilities in Papercut NG. By leveraging patch diffing and automated infrastructure, the AI developed a full proof-of-concept for unauthenticated code execution.

Twilio engineers developed a method to monitor data freshness in petabyte-scale Apache Hudi pipelines by calculating time-in-queue rather than relying on Kafka offset lag. This approach uses an external reporter to compare Kafka message timestamps with the latest Hudi commits stored in S3.

Researchers have developed MCR-Bench to move beyond static code review evaluation by simulating the iterative nature of real-world developer interactions. The study reveals that current LLMs struggle significantly with maintaining defect state consistency across multiple rounds of code changes.

This technical report details a series of critical vulnerabilities in Adobe ColdFusion, highlighted by an exploit in the RDS module. The analysis demonstrates how unvalidated input in the RDS protocol allowed for arbitrary file system access.

A critical pre-authentication remote code execution vulnerability has been discovered in IBM i Management Central. The flaw allows unauthorized attackers to execute commands with full system privileges by exploiting a custom binary protocol.