Josh chat with Roi Nisimi about some research he’s done into missing backport security fixes. Roi calls these Backport Gaps. The idea is looking for security fixes on the main branch of a project but ...

Josh talks to Keith Hoodlet about a research project he co-authored about the success rate of AI generated vulnerability patches. Keith has a very scientific approach to this paper and does a great jo...

Dark web monitoring can help security teams assess external exposure as Google pauses its open-source bug bounty program after a surge in automated reports.

Josh welcomes Amanda Brock from OpenUK to chat about sovereignty, policy, open source, and a whole host of other topics. Amanda has front row seat into how sovereignty decisions can affect a county an...

7ASecurity audited Bayanat across web, API/auth, evidence workflows, deployment, fuzzing, supply chain, and threat modeling. Read the public report.

https://www.osintinvestigate.com OpenAI is investigating a report linking its AI agents to a May 2026 attack against RubyGems. Researchers say AI agents may have uploaded malicious packages, attempted to steal RubyGems API keys, achieved remote code execution on RubyDoc servers, and used malicious packages to collect public information. OpenAI says its investigation has not verified the specific claims. In this episode, we examine what researchers discovered, what OpenAI says, and why autonomous AI agents are becoming a major cybersecurity concern.

Broadcom TrueSource combines Spring Enterprise, trusted Java, Python and Node.js artifacts, hardened containers and data services with human-verified security fixes.

7ASecurity audited Incus across six work packages. All 14 vulnerabilities and 14 of 17 hardening recommendations were resolved and independently verified.

Unvetted AI code generation in your software pipeline is like handing a construction apprentice the keys to a wrecking crane—it might get the job done, but it could just as easily knock down the…

Unvetted AI code generation in your software pipeline is like handing a construction apprentice the keys to a wrecking crane—it might get the job done, but it could just as easily knock down the…

Unvetted AI code generation in your software pipeline is like handing a construction apprentice the keys to a wrecking crane—it might get the job done, but it could just as easily knock down the…

6:00-6:30 Network - Pizza provided 6:30-7:30 Talk and Q&A 7:30-8:00 Network In February 2024, about 10% of PyPI uploads used Trusted Publishers. By October…

Josh chats with Paul Asadoorian about a tool he wrote called fettle and a recent report Paul published on CVEs. Fettle is a tool to help update and manage Linux systems. The big sell on this one is ch...

Josh chats with Patrick Garrity about the VulnCheck State of Exploitation 1H-2026 report. Patrick explains the current trends we are seeing around vulnerabilities right now. While the number of CVEs i...