AI-Accelerated Bug Discovery Drives Record Patch Volumes Across Major Software Vendors

·1 views

Microsoft's July 2026 Patch Tuesday addressed 570 vulnerabilities in a single release, more than double the previous month's record, with the surge attributed to its AI-powered internal scanning system called MDASH. The trend extends across the industry, with Mozilla patching 271 Firefox vulnerabilities found by an Anthropic AI model in one evaluation pass, and Oracle issuing 1,449 patches in its latest quarterly update, both citing AI-assisted discovery. Cisco has responded by shifting to a twice-monthly security disclosure schedule, explicitly referencing AI-accelerated vulnerability detection as the driver. A U.S. Executive Order signed in June 2026 further formalised the shift, directing federal agencies to establish an AI cybersecurity clearinghouse to coordinate scanning and patch distribution. The implications reach beyond enterprise software: a critical WordPress vulnerability chain allowing full unauthenticated site takeover was recently discovered using GPT-5.6, underscoring that AI-driven security risks now directly affect website owners and smaller operators.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How a Privacy-First Home AI Uses Cloud Models Without Sharing Personal Data

A locally-run home AI system in France operates on a two-tier model where sensitive personal data never leaves the home network. Its creator assigns every piece of information a clearance label — shareable (S0) or strictly private (S3) — determining what a more capable cloud AI is permitted to access. The cloud model is brought in only as a contractor for technical tasks like debugging, security audits, and code rewrites, working exclusively with non-personal, shareable data. The local AI handles all personal context — family activity, conversations, and documents — while the human owner acts as the final clearance authority over what crosses the boundary. The setup challenges the industry norm of consolidating all personal data into a single cloud assistant, arguing that capability and data custody can and should remain separate.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Free Node.js Tool to Automate Daily Vulnerability Checks in 5 Minutes

A developer has published a tutorial detailing how to build 'sec-watch', a roughly 600-line Node.js script that automates morning security checks for Cisco, Windows, and VMware environments. The tool consolidates data from the CISA Known Exploited Vulnerabilities catalog, Microsoft's MSRC patch feed, and Cisco's recommended software releases into a single dated HTML report. It requires no npm dependencies and runs on Node.js version 20 or higher, making it lightweight and easy to deploy. The script is designed to answer three key questions each morning: whether any tracked product is actively being exploited, what the latest Patch Tuesday covered, and whether Cisco software versions have drifted from recommended releases. A notable feature is its use of exit codes to signal to the scheduler whether any action is required, reducing the need for manual review.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Accumulated Technical Debt Stops Property Managers From Adopting AI

Technical debt in property management refers to the buildup of software shortcuts, disconnected tools, and unupdated integrations that accumulate over time and quietly drain productivity. Businesses often rely on multiple mismatched systems for tasks like tenant screening, maintenance tracking, and rent collection, forcing staff to manually re-enter data across platforms. This fragmented setup not only wastes hours each week but also creates reliability risks, as outdated integrations can fail without warning. Most critically, scattered and inconsistently structured data makes it nearly impossible to deploy AI tools, which require clean, stable data pipelines to function reliably. Resolving technical debt through unified, well-integrated systems is therefore a prerequisite for property managers looking to leverage modern AI capabilities.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AWS Bedrock and Google ADK Agents Communicate Cross-Cloud in A2A Protocol Benchmark

A developer has built and tested a cross-cloud currency conversion agent that connects an Amazon Bedrock AgentCore-hosted Strands Agents coordinator on AWS with a Google ADK agent running on Google Cloud Platform via the A2A v1.0 protocol. The experiment goes beyond basic connectivity checks, measuring latency, token overhead, and result accuracy across three evaluation modes: local MCP tool only, remote A2A delegation only, and a verified cross-check of both. Both cloud agents independently query the same Frankfurter daily exchange-rate data, ensuring any discrepancies reflect protocol or model behavior rather than data differences. Numeric agreement between agents is assessed strictly through code using relative difference calculations, avoiding any LLM-based judgment of results. The benchmark also compares AWS Bedrock AgentCore Runtime performance directly against a prior run on Microsoft Azure's Foundry platform, offering a rare empirical three-cloud comparison.

0 comments Read more at DEV Community