Carnegie Mellon University Software Engineering Institute

09/10/2026

The Department of War is increasingly using digital twins and digital engineering to support training, testing, cybersecurity, mission rehearsal, and AI-enabled analysis. But how much of the real system needs to be reproduced for an effective simulation?

In the Nov. 4 webcast "How Real Is Real Enough? A Decade of Lessons from GHOSTS," the SEI's Dustin Updyke and Matthew Butkovic draw on a decade of developing and deploying General Human-Oriented Synthetic Teammates and Systems (GHOSTS) to examine how engineers can determine the level of realism needed and decide what must be modeled--including networks, users, organizations, adversaries, and autonomous agents--and what can safely be left out - https://events.zoomgov.com/ev/AsFKaBZclrg-380IvZ2LTzLR9DOOS7AOpHVnT-tLQ8yOBpevI35I~Ai79iWPleSo0EBvoK-RNkswskc5q2KXxm6ShqQlkIe6NQ9dR0l336pVzQA

09/09/2026

A New Note: Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability - https://kb.cert.org/vuls/id/859658

09/09/2026

A New CERT Vulnerability Note: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability - https://kb.cert.org/vuls/id/943094

09/08/2026

The SEI has opened registration for Mission Ready Research 2026: Innovation in Action. This free, in-person event on November 18 and 19 in Pittsburgh will showcase the SEI’s latest achievements and research advancements in artificial intelligence, cybersecurity, and software engineering.

Participants can engage directly with the SEI engineers and researchers transitioning innovation to drive demonstrable results, meet with SEI staff to discuss solutions to today’s challenges, and establish a mission partnership with the SEI. Demonstrations will provide hands-on experience with the latest software solutions - https://www.sei.cmu.edu/news/mission-ready-research-event-to-demonstrate-innovation-in-action/?utm_source=social&utm_medium=fb&utm_campaign=news_fb

09/04/2026

A New CERT Vulnerability Note: Casdoor authentication server is vulnerable to authorization bypass - https://kb.cert.org/vuls/id/889462

09/03/2026

The appeal of applying AI to MBSE is apparent. Our latest post explores how to integrate AI without weakening engineering rigor -

The appeal of applying AI to MBSE is apparent. This post explores how to integrate AI without weakening engineering rigor.

09/02/2026

Check out the latest Tactical Guide in the Software Acquisition Go Bag, "The Key to SWP Success: The User Agreement" -https://www.sei.cmu.edu/documents/6567/The_Key_to_SWP_Success_The_User_Agreement.pdf

Collaboration among the Program Management Office, the Product Team, and users is paramount to the success of software acquisition. The user agreement is the cornerstone of that collaboration and a key document for programs on the Software Acquisition Pathway. Even those not on the SWP, but who are using Agile development methods, should consider developing and adopting a user agreement to get commitment from users to participate throughout the software development lifecycle.

09/01/2026

A New CERT Vulnerability Note: Hugging Face Transformers library writes remote code to disk prior to consent check - https://kb.cert.org/vuls/id/456290

08/31/2026

A New CERT Vulnerability Note: Remote Code Ex*****on and Arbitrary File Read Vulnerabilities in Kaltura Servers - https://kb.cert.org/vuls/id/308749

08/28/2026

As open‑source ecosystems grow ever more central to modern software development, the traditional view of Coordinated Vulnerability Disclosure (CVD) as a “nice‑to‑have” becomes dangerously inadequate.

In a recent talk at the 38th Annual FIRST Conference, “From CVD to Secure Releases: Automating Security from Source to Releases,” the SEI's Vijay Sarvepalli and Christopher Cullen argue that CVD must evolve: not just to notify, but to actively secure software supply chains, builds, releases, and audit tools. By integrating CVD into developer workflows on platforms such as GitHub, GitLab, and public registries like npm and PyPI, we can shift security “left,” enforce continuous policy checks, and ensure that disclosure actually leads to safer software in production -

Vijay Sarvepalli (Software Engineering Institute, US), Christopher ...