Michael Catanzaro argues that AI-driven vulnerability scanning has become indispensable for maintaining secure GNOME software in 2026: humans repeatedly introduce exploitable bugs when using unsafe languages like C, C++, and Vala, and modern language models now find many of those issues reliably. AI reports have improved since 2025 and can also surface non-security bugs, but they bring new burdens - verbosity, exaggerated severity, occasional inaccuracies and fabricated details, and an overwhelming volume that strains volunteer maintainers. Rewriting AI-generated reports is impractical at scale, so maintainers should permit AI-originated vulnerability reports rather than banning them; projects that prohibit such reports should not be dependencies for GNOME.
Concrete data back the claim: GNOME CVEs rose sharply from the low tens in 2021-2023 to 141 reported year-to-date in 2026 (normalized to ~188), and WebKitGTK saw an explosion to 305 CVEs in 2026 driven largely by bundled Skia and ANGLE issues. A short-lived GNOME bug bounty program received 298 submissions, accepted 71, and paid €183,900 (mean €2,662.99) before closing because the inflow was unsustainable. Security tracking has been paused, so official CVE counts will drop unless others assume that work.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A suspected pneumonic plague outbreak in Irkutsk, Russia, has prompted quarantine measures and government denial, raising concerns about a potential bioweapon leak. If true, the engineered bacteria could be highly virulent and pose a significant global threat. (lesswrong.com)
GitHub experienced an incident affecting its services, as detailed on their status page. The issue prompted notifications and updates for users subscribed to incident alerts. (githubstatus.com)
RemoveMacAI is an open-source tool that deletes 12GB of Apple Intelligence data on macOS, disabling AI features and removing related models. It also prevents the models from being downloaded again, enhancing user control over AI data. (theverge.com)
After being banned from traditional sports betting sites due to his gambling addiction, Thomas turned to Kalshi, a prediction market platform. The dark side of the prediction market boom is emerging as these sites become outlets for relapse among gambling addicts, with companies avoiding consumer protections. (npr.org)
OpenSSH, widely used for secure remote access on servers and desktops, includes code that was compromised to introduce a backdoor via liblzma. The attack targeted Linux systems relying on systemd, while OpenBSD remained unaffected due to its different architecture. (zbruceli.org)
One person has become a quorum at the SEC, allowing for decisions to be made without a full commission. The new rule takes effect on October 2, 2026. (ft.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.