Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
PCI SSC published Security Considerations for AI Systems on 15 September 2026. It is guidance, but it sets clear expectations for AI agents that touch cardholder data.
GitHub published 28 PraisonAI advisories on 7 and 8 October 2026, three critical. Most come down to servers with no auth by default and sandboxes that don't sandbox.
Open WebUI published 19 advisories on 9 and 10 September 2026, all fixed by 0.11.1. Most need a specific setting to be on. Here is how to map them to your deployment.
CVE-2026-107295 and CVE-2026-107292 let a web page drive a Pydantic AI agent served on localhost, tools included. Published 8 October 2026 with seven other advisories.
Hugging Face Transformers wrote a repo's custom_generate/generate.py to disk before asking for trust_remote_code consent. Fixed in 5.17.0, though the advisory still lists no patch.
A LiteLLM proxy user could reroute an upstream call and make the proxy send its own provider credentials along. Published 30 September 2026, fixed on nine release lines.
vLLM published eight advisories on 5 and 6 October 2026. Most let a single request crash or starve an engine shared by every tenant. All are fixed by 0.30.0.
An integer overflow in a vLLM CUDA kernel could copy one user's response into another's in the same batch. It led eight vLLM advisories published in September 2026.
GHSA-gqvg-gmmx-x4hm: with MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False, a model tagged as statsmodels still unpickled and ran code. Fixed in MLflow 3.15.0.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
