WealthLab

Layered Linux kernel security review and patch workflow

OpenAI Found 948 Linux Kernel Bugs. That Is Not a 948-Patch Emergency

OpenAI's agent pipeline produced 948 Linux kernel patches, but maintainers still have to review relevance, duplicates, affected versions, and fixes.

An isolated agent computer separated from its orchestration and network policy layers

Google Agent Compute Engine Changes the Runtime Question

Google plans a microVM service that separates the agent harness from an isolated computer. Here is what is confirmed, what remains open, and who should wait.

A coding agent isolated behind layered sandbox and file-transfer boundaries

Docker Sandboxes 0.51.0 Closes an sbx cp Path Escape

CVE-2026-103916 crossed the sandbox boundary through a user-run copy, not a microVM escape. Here is who is affected and why the distinction matters.

Layered authorization and sandbox boundaries around an AI security agent

AI Security Sprints Need Two Boundaries: What OpenAI and Hugging Face Changed

OpenAI is expanding model-assisted security work, while the Hugging Face incident shows why authorization and containment must be designed separately.

GitHub Actions workflow trust boundaries between pull requests and privileged repository automation

GitHub Will Block pull_request_target by Default: Who Must Act Before December 2

GitHub's December 2 secure default changes how public repositories run pull_request_target workflows. Learn who is affected and how to preserve safe automation.

Diagram comparing ephemeral hosted runners with isolated self-hosted runners for agentic workflows

GitHub Agentic Workflows Is GA—Should You Self-Host It?

GitHub Agentic Workflows is generally available. This decision guide examines the security boundary, self-hosted runner trade-offs, and safer first use cases.

Abstract registry token moving between a personal account and an organization

GhostPat Changed Who a Docker Hub Token Belonged To

Docker fixed a Hub account-conversion flaw that could silently reassign a live personal access token. Here is what the incident means for registry trust and cleanup.

Docker Desktop logs and diagnostics flowing through an update boundary to credential review

Docker Desktop 4.97.0 Fixes Credential Leakage—but Copies May Remain

CVE-2026-114409 could expose third-party API keys and OAuth tokens in local logs. Updating cleans host files, but exported copies need separate review.

Risk map grouping n8n security advisories into execution, credential, public endpoint, and data integrity paths

n8n's October 28 Security Batch: Map Exposure Before You Patch

n8n published 12 advisories spanning code execution, credential leakage, public endpoints, and data integrity. Here is how to prioritize exposure.

Diagram showing a GitHub App issuing a short-lived token to a controlled Copilot SDK service

GitHub Copilot SDK Server Authentication: Operator Checklist

GitHub Apps can now authenticate Copilot SDK services without a user session. Review permissions, token handling, access policy, and rollback first.

Diagram of portable agent skills moving through governance, review, isolation, and controlled deployment

Agent Skills Moves to AAIF: What Operators Should Change

Agent Skills now has a vendor-neutral home, but portability is not a security boundary. Use this adoption and review checklist before running a skill.

Node.js fixed runtime versions and a container rebuild and deployment checklist

Node.js October 2026 Security Release: A Container Patch Checklist

Node.js fixed high-severity Brotli, TLS, and DNS flaws. Container operators should update, rebuild, redeploy, and verify the runtime—not only npm packages.

Latest