Every story tagged Code Security, curated for CIOs and IT leaders — ranked by source credibility, engagement, and freshness.
7 stories · open in the command center
Memory safety in systems programming is evolving beyond the traditional Rust-versus-C/C++ debate, with new technologies like Fil-C offering alternative approaches to prevent memory vulnerabilities in existing languages. While Fil-C and similar tools present viable options, they introduce trade-offs (performance, ABI incompatibility, garbage collection) that make them unsuitable for all use cases, meaning pragmatic organizations should evaluate multiple memory-safe solutions rather than adopting absolutist positions. IT leaders should recognize that Rust's real-world vulnerability density is orders of magnitude lower than C/C++ (0.2 vs. 1,000 per million lines of code), making it a proven risk-reduction strategy alongside emerging alternatives.
OpenText conducted hands-on training for partners on its Application Security Aviator solution, emphasizing AI-driven vulnerability detection capabilities and an offline mode for secure environments. This initiative strengthens the partner ecosystem's ability to deliver advanced application security solutions, particularly for organizations requiring proof-of-concept deployments and air-gapped infrastructure support. The training underscores OpenText's commitment to enabling partners to address the growing demand for AI-powered security tools in enterprise application development.
Verus is a formal verification tool that uses automated theorem proving to mathematically prove the correctness of Rust code without runtime overhead, addressing critical security and reliability needs in low-level systems development. For IT organizations, this enables a shift-left approach to security by catching logic flaws and vulnerabilities at compile time rather than in production, reducing costly recalls and security incidents in mission-critical infrastructure. CIOs should consider Verus adoption for high-assurance systems (cloud infrastructure, security modules, automotive/aerospace software) where correctness failures carry substantial business, safety, or compliance consequences.
Enterprise software contains widespread 'phantom' binary dependencies—precompiled code dependencies that aren't tracked in manifest files—creating critical blind spots in security vulnerability management and open source sustainability efforts. Unlike source code dependencies, these hidden binary relationships prevent organizations from accurately assessing their attack surface, identifying which maintainers need financial support to prevent burnout, and ensuring timely security patches across the full dependency stack. This threatens critical infrastructure including healthcare systems, transportation networks, and internet services, as IT organizations cannot protect against vulnerabilities they cannot see.
A critical vulnerability in iTerm2's SSH integration feature allows malicious content in plain text files to execute arbitrary code when viewed with 'cat', exploiting the terminal's trust model by impersonating legitimate remote conductor protocol messages. This represents a fundamental class of supply chain and social engineering risk where simply viewing documentation, log files, or server responses can compromise systems. The vulnerability demonstrates how modern terminal features that enhance productivity can inadvertently expand the attack surface beyond traditional command execution vectors.
Gitar ($9M Series A) addresses the emerging 'code overload' crisis where AI-generated code is overwhelming engineering teams with quality and security issues that require senior engineer intervention. The platform uses AI agents to automate code reviews, CI/CD workflows, and security validation, positioning itself uniquely on post-generation code quality rather than code generation. This represents a strategic shift toward automated code validation that could significantly reduce senior engineer review overhead while accelerating deployment cycles, though it requires careful consideration of governance and the balance between automation and human oversight.
N-Day-Bench is a continuously updated benchmark that measures the ability of frontier LLMs to identify real-world security vulnerabilities in actual codebases, with leading models (GPT-5.4, GLM-5.1, Claude Opus-4.6) achieving 80-84% success rates in finding post-training vulnerabilities. This represents a significant maturation of AI-assisted security capabilities that could reshape vulnerability discovery workflows and reduce time-to-detection for critical security flaws. For IT organizations, this signals both an opportunity to augment security teams with AI-powered vulnerability detection and a strategic risk as adversaries gain access to similar capabilities for exploit development.