Python’s CVEs Triple. Anthropic Funds a New Security Developer

In the last year CVEs have increased 3x for Python and its package manager Pip, according to Python’s security developer in residence Seth Larson. “And the amount of malware published and removed from the Python Package Index (PyPI) is up 60%.” Securing Python’s ecosystem is getting more complex, he writes, especially given “the evolving role of AI in both security risks and security response.”

Their response includes bringing on a new Security Developer “to address the increasingly demanding scale of security response for the Python ecosystem.”
Providing prompt security response services and innovating to prevent future threats… is more difficult now than ever before… [Security developer Brett Smith] will help us keep pace with critical ongoing work such as vulnerability remediation, providing vulnerability data as a CVE Numbering Authority, and removing malware from PyPI. He’ll also give the team bandwidth for new projects such as scaling PyPI’s autonomous quarantine program to reduce manual effort on malware remediation and streamlining processes for the PSRT to handle the new vulnerability report volume.

The role was made possible by an “ecosystem security” grant from Anthropic. And having the new security developer “will both build capacity for security work the PSF already does and enable new, proactive work,” concludes Python’s security developer in residence. (He discussed Python’s security challenges in a June presentation with Python security engineer Mike Fiedler> .)

In June, Curl’s Daniel Strenberg reported Curl’s CVEs have also tripled.

Read more of this story at Slashdot.