Daily Vibe Casting (@vibecastingapp) on X

What it is

Item 5/10 of a Daily Vibe Casting thread (the 24-hour tech news roundup) points to a Cloudflare security audit "skill" for coding agents. The linked GitHub path is truncated on the page ("github.com/cloudflare/sec…"), so the repository name is not confirmed. The thread author recommends it, and that recommendation is the only evaluation given. The page offers no test results.

What to do

The author's advice on using the skill:

• Run it on all your software.
• Run it with free models.
• Run it even on code a model has already audited. The author says it "will find much more things."
• It works in any agent harness and is model independent.

The thread says audits should use sandboxing, proof of real impact and independent checks. Reports are machine-readable, so they can feed triage or CI tooling. The page does not describe the report schema, the checks performed or the install steps.

Other security items in the same thread

These come from short summaries in the thread, not from primary advisories.

• GitLab: CVE-2026-110264 has a CVSS score of 10.0. It allows unauthenticated code execution on self-managed servers. About 12 years of releases need urgent upgrades. GitLab.com is already protected.
• PHP: Two AI-discovered flaws allow remote code execution without login. Patches cover PHP 8.2 and newer. No exploitation has been reported. Some European governments took public sites offline, per the BBC. Wiz called the flaws the "most severe vulnerabilities ever discovered" by AI (the quote is cut off on the page).
• Railway: Possible theft of customer secrets. Builds and deployments were paused while upstream providers were asked to revoke keys. Users were urged to rotate secrets and check service logs.
• ICO reprimand: A 2024 ransomware attack used a test account whose password, "Password1", had gone unchanged for 12 years. Data of 3,300 people was exposed, mostly children.

Caveats

The thread gives no fixed GitLab version numbers, no PHP version numbers beyond "8.2 and newer", and no CVE ids for the PHP flaws. Check vendor advisories before patching. The claim that the Cloudflare skill finds more than a prior model audit is the author's opinion and is not backed by data on the page.