Weekly Briefing - 18-08-2026
Corgea's weekly briefing for 12-18 August 2026 covers the StubMaker RubyGems typosquat wave, LiteLLM's August blast-radius disclosure, and the JupyterLab PyPI extension-manager bypasses.
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
260 matching stories — in Secrets Detection — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Corgea's weekly briefing for 12-18 August 2026 covers the StubMaker RubyGems typosquat wave, LiteLLM's August blast-radius disclosure, and the JupyterLab PyPI extension-manager bypasses.
Fresh 15-18 August reporting on the StubMaker campaign shows how RubyGems typosquats such as `brumdler` and `brundlef` abused `extconf.rb` to fake a successful native-extension build, beacon over plain HTTP, fetch a Rust loader from GitHub Releases, and unpack an in-memory Go stealer that targeted Chromium secrets, wallet material, and Telegram data.
Black Hat USA 2026 didn’t introduce the AI security problem, but made it clear how fast that problem is becoming operational. An independent study initiated and funded by Checkmarx helps explain why. On real-world repository tasks, frontier models produced working code 83% to 95% of the time, but only 24% to 36% of their solutions […]
Dependabot bumps the version. ZeroPath makes sure the upgrade doesn't add a new CVE, proves transitive fixes in a sandbox, and flags which of your call sites might break.
An OpenAI model under evaluation broke out of its sandbox and into Hugging Face's infrastructure to steal the answers to the benchmark it was being graded on. Reward hacking explains it better than any of the individual vulnerabilities do.
Three August 2026 JupyterLab disclosures show the PyPI extension-management path could misapply administrator policy: blocklists compared non-canonical package names, `/lab/api/plugins` trusted incomplete lock enforcement, and a related `PyPIExtensionManager.install()` path skipped its own allowlist check because of a missing `await`.
Learn about monitoring the end-to-end health and performance of modern data pipelines.
Software companies used to worry about someone walking out the door with a hard drive... The post Intellectual Property Leakage: Risks, Detection, and Prevention appeared first on Cycode.
AI agents now write code, pull dependencies, run tests, and open pull requests inside enterprise pipelines, sometimes without a developer ever opening an IDE... The post Agentic Development Lifecycle (ADLC): What You Need to Know appeared first on Cycode.
A critical CVE lands in your backlog... The post Agentic SCA: Triage, Mitigate, and Fix Exploitable CVEs Without Breaking Changes appeared first on Cycode.
Learn how secretless authentication for Datadog’s Azure integration helps prevent telemetry interruptions that result from expired client secrets.
Learn how Product Analytics account segments combine business context and product behavior to identify accounts that may be at risk of churn.
CVSS rates worst-case severity, not real risk. ZeroPath layers four signals on every dependency CVE: the real advisory CVSS, CISA KEV, FIRST EPSS, and an AI-derived contextual severity for your repo, refreshed daily and kept honest.
Now available in Early Access for SAST within Checkmarx One, Checkmarx Fusion adds a new detection layer that advances vulnerability-finding accuracy beyond what rules-based scanning or an AI model can achieve alone.
TL;DR: A security engineer opens four terminals before breakfast: one for Gitleaks, one for npm audit, one for Semgrep, one...
A benchmark test at OpenAI went looking for a way out of its sandbox in mid-July, found one, and ended...
AI is generating code faster than teams can review it. Learn how hybrid SAST and Checkmarx Fusion help detect AI-era software security risks.
Every technology shift creates the same tension: the tools that make individuals faster make it harder for organizations to govern....