GitHub Secret Scanning: Why a Small Model Beat the LLM Pipeline
GitHub secret scanning swapped an LLM for a fine-tuned ModernBERT classifier: 86% faster scans, 98% lower cost, fewer false alarms. How it works for teams.
CVE Severity Scores Are Inflated: JFrog's 96% Finding
JFrog's security team found 96% of critical CVEs warranted a lower rating. Their prototype pollution research exposes why CVSS scores routinely misrepresent real-world exploitability.
Checkmarx's New SAST Engine Isn't About the LLM. It's About What Comes After.
Checkmarx unveiled a hybrid SAST engine with three components — a deterministic scanner, an LLM trained on security data, and a Finding Analysis Engine that filters false positives before results reach developers. The differentiator is the last one.
PixelSmash: The FFmpeg Heap Overflow That Turns Media Files Into Attack Vectors
CVE-2026-8461 is a CVSS 8.8 heap out-of-bounds write in FFmpeg's MagicYUV decoder — enabled by default, triggerable without user interaction, and already demonstrated as RCE against Jellyfin and Nextcloud.
Datadog's BewAIre: From 97.4% to 99.86% Accuracy on Malicious Package Detection
Datadog's BewAIre system detects malicious code in npm and PyPI packages with 99.86% accuracy using a two-stage AI pipeline — a lightweight filter that exits 95% of packages cheaply, then an agentic investigation loop for everything that looks suspicious.
Datadog's Open Source AI SAST: 90% Detection, Fewer False Positives
Datadog released an open source AI-native SAST tool that hits 90% command injection detection on OWASP benchmarks — up from 59% with traditional rules. Here's the architecture and why false positives were the real problem.
Datadog Code Security MCP: Security Scanning Inside AI Code Generation
Datadog launched an MCP server that runs SAST, SCA, secrets detection, and IaC scanning during AI code generation — catching vulnerabilities before they reach a pull request.
Betterleaks: The Gitleaks Successor Built for Agentic Secrets Scanning
Gitleaks creator Zach Rice rebuilt the tool from scratch with 98.6% recall, CEL-based validation, and CLI design built for AI coding agents operating code pipelines.
Datadog Bits AI Dev Agent: Automated Vulnerability Remediation at Scale
Datadog's Bits AI Dev Agent opens GitHub PRs to fix SAST findings automatically — closing the security backlog that manual triage alone can't clear.