CISA

Evidence (4)

• 7Hacker News·8/3/2026security
  JFrog Questions Critical SQLite CVEs as AI-Generated Slop

  JFrog security researchers investigated a set of recently published SQLite CVEs that NVD and CISA had marked as critical or high. They reported that the cited code paths did not match the referenced SQLite versions, the proof-of-concept payloads did not reproduce crashes, and the advisories showed multiple signs of AI-generated content.

• 7The New Stack·7/9/2026security
  CISA pushes deeper SBOM checks for hardened images

  The article discusses updated 2025 CISA guidance saying SBOMs should include all components, including transitive dependencies, with no minimum depth, plus configuration files and fork lineage. It argues that security teams should validate hardened container images with quick “sniff tests” to catch incomplete inventories, improve vulnerability response, and reduce supply chain risk.

• 7The New Stack·6/30/2026security
  Aikido buys Root to backport open source security fixes

  Aikido Security has acquired Root for $70 million and will fold its in-place vulnerability patching into a new product called Aikido Libraries. The company says it will also backport fixes for actively exploited vulnerabilities on CISA’s KEV list to open source projects for free across ecosystems including npm, PyPI, and Maven. The deal aims to reduce the gap between finding a vulnerability and fixing it without forcing immediate upgrades.

• 6The New Stack·6/24/2026security
  Azul launches free JVM vulnerability scan amid AI exploit warnings

  Azul Systems is offering a free JVM vulnerability risk assessment to help teams discover unpatched Java runtimes, including embedded and unmanaged instances, before they are exploited. The scan prioritizes remediation using CISA KEV and the U.S. National Vulnerability Database, while also serving as a lead-in to Azul Core subscriptions and its security-only patching approach.