Chainguard, Cyber Firms Use AI to Hunt for Open-Source Flaws

This report discusses an initiative by Chainguard and several major cyber firms to use AI technology to identify vulnerabilities in open-source software. The coalition includes prominent organizations such as BNY Mellon, Cisco, Cloudflare, Docker, JP Morgan, and PWC. The effort aims to improve security by proactively hunting for flaws, potentially including remote code execution (RCE) vulnerabilities. No specific vulnerabilities or exploits are detailed in the report.

• bloomberg.com/news/articles/2026-06-15/chainguard-cyber-firms-use-ai-to-hunt-for-open-source-flaws (opens in a new tab)
• reddit.com/r/cybersecurity/comments/1u6r7wq/chainguard_cyber_firms_use_ai_to_hunt_for/ (opens in a new tab)

• ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracingTool2026-10-28
• ZDI-26-830: Apple Safari jsToWasm IC Entrypoint Type Confusion Remote Code Execution VulnerabilityHighVulnerability2026-10-28