VulnHub

Real-time Cybersecurity News

OpenAI Codex Security Scanned 1.2 Million Commits and Found 10,561 High-Severity Issues

The Hacker News
Critical

Overview

OpenAI has launched Codex Security, an AI-driven tool aimed at identifying and addressing vulnerabilities in software projects. In its initial scan of 1.2 million code commits, the tool uncovered over 10,500 high-severity security issues. The feature is currently available in a research preview for various ChatGPT users, with free access for a month. This development is significant as it helps developers proactively manage security flaws in their code, which is increasingly critical as software complexity grows. By automating the detection and suggestion of fixes, Codex Security could improve overall code safety and reduce the risk of breaches.

Key Takeaways

  • Affected Systems: OpenAI Codex Security, ChatGPT Pro, Enterprise, Business, Edu customers
  • Action Required: Implement fixes proposed by Codex Security.
  • Timeline: Newly disclosed

Original Article Summary

OpenAI on Friday began rolling out Codex Security, an artificial intelligence (AI)-powered security agent that's designed to find, validate, and propose fixes for vulnerabilities. The feature is available in a research preview to ChatGPT Pro, Enterprise, Business, and Edu customers via the Codex web with free usage for the next month. "It builds deep context about your project to identify

Impact

OpenAI Codex Security, ChatGPT Pro, Enterprise, Business, Edu customers

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Newly disclosed

Remediation

Implement fixes proposed by Codex Security

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Critical.

Read Original Article

Related Coverage

Ericsson US discloses data breach after service provider hack

BleepingComputer

Ericsson Inc., the U.S. branch of the Swedish telecommunications company, has reported a data breach resulting from a cyberattack on one of its service providers. The breach has led to the theft of sensitive information belonging to an undisclosed number of employees and customers. While the company has not specified the exact nature of the stolen data or the service provider involved, this incident raises significant concerns about the security of third-party vendors and their impact on larger organizations. The breach highlights the ongoing risks companies face from attacks that exploit vulnerabilities in their supply chains. Users and businesses associated with Ericsson should remain vigilant and monitor for any unusual activity related to their data.

Mar 9, 2026

Microsoft Teams will tag third-party bots trying to join meetings

BleepingComputer

Microsoft is rolling out a new feature for Teams that will automatically tag third-party bots trying to join meetings. This update will place these bots in a lobby, giving meeting organizers the ability to control whether they can enter the meeting or not. This move aims to enhance security by preventing unauthorized or unwanted bots from participating in discussions. It’s particularly significant for organizations that rely on Teams for sensitive communications, as it allows them to maintain better oversight over who can access their meetings. As more companies integrate bots into their workflows, ensuring that only trusted applications can join meetings becomes increasingly important for maintaining data security and privacy.

Mar 9, 2026

FBI warns of phishing attacks impersonating US city, county officials

BleepingComputer

The FBI has issued a warning about a series of phishing attacks where criminals are posing as U.S. city and county officials. These attacks primarily target businesses and individuals seeking planning and zoning permits. Scammers use these impersonations to trick victims into providing sensitive information or money. This situation is concerning as it can lead to financial losses and undermine trust in local government processes. The FBI urges anyone involved in such applications to verify the legitimacy of communications before responding, especially if they involve requests for personal or financial information.

Mar 9, 2026

Why Password Audits Miss the Accounts Attackers Actually Want

BleepingComputer

Password audits are often ineffective because they focus mainly on complexity rules rather than the types of accounts that hackers are actually targeting. According to Specops Software, many organizations overlook risks associated with breached passwords, orphaned user accounts, and service accounts, which can create significant vulnerabilities. These accounts are often less monitored and can provide attackers with easy access if compromised. This situation is concerning because it means that organizations may feel secure while they are actually exposed to real threats. Companies need to reassess their password management strategies to include a focus on these high-risk accounts in order to better protect their sensitive information.

Mar 9, 2026

Chinese Cyber Threat Lurks In Critical Asian Sectors for Years

darkreading

A Chinese-speaking cyber actor has reportedly been targeting critical sectors in Asia for several years using a mix of custom malware, open-source tools, and living-off-the-land (LOTL) binaries. This activity appears to be focused on espionage, affecting both Windows and Linux systems. The attackers' tactics, which combine tailored malware with readily available tools, suggest a sophisticated approach aimed at infiltrating sensitive networks. The long-term nature of this threat raises concerns for organizations in the region, as prolonged access could lead to significant data breaches and intelligence gathering. Companies in critical infrastructure sectors need to be vigilant and enhance their cybersecurity measures to defend against these persistent threats.

Mar 9, 2026

Cloned AI Tool Sites Distribute Malware in ‘InstallFix’ Campaign

SecurityWeek

A recent campaign called 'InstallFix' is targeting users through cloned websites that mimic legitimate AI tool installation pages. Attackers are replacing genuine commands with malicious ones, leading to the distribution of malware to unsuspecting users. This tactic poses a significant risk, especially for individuals seeking AI tools, as they may inadvertently download harmful software. Researchers have identified these cloned sites as a growing threat, urging users to be cautious when downloading software from unfamiliar sources. The implications are serious, as this can lead to compromised systems and data loss for both individual users and organizations.

Mar 9, 2026