Software Development | News, how-tos, features, reviews, and videos
The vulnerability impacts self-managed CE and EE instances and provides an unauthenticated path to arbitrary file reads. It’s already being probed in the wild.
The release spans runtime, plugins, and secret handling as the project describes an evolution into ‘OpenClaw 2.0.’
The type confusion vulnerability allows a guest-to-host sandbox escape which can lead to remote code execution
Attackers don’t need credentials or user interaction to exploit the flaw which could enable supply chain attacks in self-hosted code repositories.
Top IT leaders get it—if it’s high quality, with security “built-in” throughout development, software can make a business successful.
China's AI developer claims GLM-5.3 rivals leading Western models in vulnerability discovery and has identified thousands of security flaws across real-world software.
Your developers trust their tools. That trust is being exploited.
The biggest challenges weren’t prompt injection or model vulnerabilities. They emerged after the AI already had permission to act.
The vulnerability abuses Active Storage, allowing unauthenticated attackers to read sensitive files and potentially take over applications.
The Shai Hulud variant’s blast radius includes several highly popular packages thus far.. Security teams are urged to perform full audits of all developer machines.