Security researcher Doyeon Park disclosed a critical 0-day vulnerability in Cosmos' CometBFT consensus layer that can deadlock nodes. He slammed officials for ignoring proof-of-concept, downgrading severity to dodge bounty, and marking his report as spam.
GitHub said a breach tied to a VS Code extension gave attackers access to about 3,800 internal repositories. The company said it has no direct evidence that user repositories, organization accounts, or customer data were affected.
OpenClaw v2026.4.23 adds OAuth-based access for GPT-image-2, brings conversation inheritance and three-level subagent nesting, and builds on fixes for 13 CVEs disclosed earlier in April.
Bitcoin Core disclosed its first memory safety vulnerability CVE-2024-52911, allowing miners to remotely crash nodes and execute code. An estimated 43% of nodes remain on unpatched versions.
A new push around BIP-110 argues the proposal could filter 41.5% of spam transactions and recover 36% of block space without blocking sampled financial transfers, sharpening the divide over Bitcoin’s role as money or a broader data layer.
PromptArmor says Microsoft 365 Copilot Cowork can be abused through a malicious skill file, allowing silent exfiltration of sensitive SharePoint and OneDrive documents without clear user approval.
Nous Research's Hermes Agent features a built-in learning loop and one-click migration from OpenClaw, reaching 69.9k GitHub stars and called the most ambitious open-source agent release of 2026.
OpenAI published an internal report detailing how it secures its AI coding agent Codex in production—using sandboxes, auto-approval for low-risk actions, and an AI classifier to triage alerts.
