Carnegie Mellon University news and milestones

Carnegie Mellon University Startup Week brings thousands of people from the startup, research and investment worlds together to learn and swap ideas. Participants from last year'…

Konami's Metal Gear Online 3 contains a heap-based buffer overflow

By Sean Murphy OVER 2,500 successful Donegal students who got their results and celebrated over the weekend are now anxiously awaiting offers. The grades were revealed last Frida…

Timelines for fully removing pandemic-related post-marking adjustment will continue to be informed by the 2026 experience

Calix GS7 XGS GS5239XG residential router contains missing authentication vulnerability

All Leaving Cert students have had their marks boosted automatically by 4% this year, down from a figure of 5.8% in 2025.

RDK-B WebUI contains multiple vulnerabilities

TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks

OpenCart ecommerce platform contains directory traversal vulnerability

The nothings stb TrueType library, up to version 1.26, contains a heap buffer overflow vulnerability

Certbot wrote a new fullchain.pem and exited 0. openssl on :443 still shows last month's notAfter. Prove disk vs wire, reload nginx, add a deploy hook.

This week, the websites of major Russian banks-Sber, VTB, Rosselkhozbank, T-Bank, Uralsib, Promsvyazbank and Bank Saint Petersburg-began serving TLS certificates issued by Russia…

Certbot exited 0. Disk has a fresh fullchain.pem. openssl on :443 still shows last month's notAfter. Five failure modes, each with one command.

Rotate a trust anchor in the wrong order, and you cause the outage you were avoiding. The 4-step sequence uses cert-manager and trust-manager.

Get the limited-edition ISRG Root X1 t-shirt when you give $75 or more this summer.

I taught swamp to drive FreeIPA, then used it to issue my laptop an 802.1X client cert and get onto my own network. Mostly this is about knowing when to write things down.

Tenda firmware (multiple versions) contains hidden authentication backdoor

In healthcare settings where patients use LLMs as a medical assistant, LLM performance differs between evaluation and deployment. (a) Bean et al. (2025) find a 61 percentage poin…

Zero trust frameworks tailored to the unique requirements of OT systems are just beginning to emerge. The SEI is pioneering research into the application of zero trust principles…

Connectivity checker trips browser alarms thanks to lapsed security paperwork

Missing IPsec Integrity Protection for IMS SIP Signaling in Verizon VoLTE Deployments

Community Emergency Response Team (CERT)Back in 2024 I completed the CERT training course, and the kit they give you for free is really basic and could do with some upgrades. Its…

What do a SERVFAIL on one specific zone and one specific resolver path, instant resolution on every other zone, and forty-two hours of failed cert renewals that nobody was watchi…

CERT-EU - High Vulnerability in the Linux Kernel ("Copy Fail")

Recent advances in large language models (LLMs) have enabled AI agents to perform increasingly complex tasks in web navigation. Despite this progress, effective use of such agent…

This curated resource aims to help you integrate AI tools into your daily academic and professional workflows.

Compiler Design

Materials from our SIGGRAPH

The Part of PostgreSQL We Hate the Most, Andy Pavlo - Carnegie Mellon University,

Databases in 2025: A Year in Review, Andy Pavlo - Carnegie Mellon University,

Researchers develop a camera with spatially selective focusing, allowing the lens to focus on objects at many different distances at once.

HTTP/2 implementations are vulnerable to "MadeYouReset" DoS attack through HTTP/2 control frames

SMM callout vulnerabilities identified in Gigabyte UEFI firmware modules

In this webcast, Leigh Metcalf and Edward Schwartz explore ways to improve reproducibility in academic malware research so new cybersecurity concepts and tools can be adopted mor…

Suppose somebody has been rubbing gasoline on their body since the 1970s.... Read More +

The recently released open source tool provides software development and cybersecurity teams a consistent, repeatable process.

This paper describes verification and certification challenges for avionics software.

Part 2 of this SEI Blog series discusses the architecture of a new stock exchange trading system developed in collaboration with Bursatec.

In this paper, researchers from the SEI and OpenAI explore the opportunities and risks associated with using large language models (LLMs) for cybersecurity tasks.

The U.S. Department of Defense awards billions in research grants to Pittsburgh's Carnegie Mellon University, sparking some student opposition.

The use ofmachine learning (ML)could improve many business functions and meet many needs for organizations. For example, ML capabilities can be used to suggest products to users…

In this report, the authors present the as-if infinitely ranged (AIR) integer model, a mechanism for eliminating integral exceptional conditions.

This post provides an overview of explainability in machine learning and includes illustrations of model-to-human and human-to-model explainability.

The Vulnerability Notes Database provides information about software vulnerabilities.