What it is
Striga describes itself as source-code auditing built on artificial intelligence. Its public site says audits use full-codebase context, combine machine-learning and static-analysis layers, assess exploitability, generate proof-of-concept payloads, and keep a human reviewer in the loop.
For Bugflation, the important scope is narrower: Striga has public CVE material and research write-ups where Striga, a Striga scan, or a security assessment using Striga appears in the discovery story.
What is verified
The ledger now indexes all 21 CVEs visible in Striga’s public tracker. The set spans Apache HTTP Server and Shiro, Logseq, Apple container, Ollama, pac4j, Tomcat, axios, n8n, Mattermost Desktop, OpenClaw, FreshRSS, and Electron. The newest row is Electron CVE-2026-70609.
Striga’s May 6, 2026 Apache write-up strengthens the entry. It says Striga
surfaced the bug during open-source research on Apache httpd 2.4.66, that the
end-to-end scan ran on open-weights models, and that the compute cost was under
$100. The write-up also describes the mod_http2 double-push root cause, a
worker-crash trigger, and a lab RCE chain that assumes known system() and
scoreboard addresses.
Upstream vendor advisories, CERT Polska reports, Apache security notes, and GitHub Security Advisories corroborate the affected projects and fixes. Striga’s own tracker and research posts supply the AI-platform attribution, which remains labeled self-reported unless an upstream source names the system.
What is held out
The under-$100 Apache httpd compute-cost claim is now public in Striga’s own write-up. Bugflation records it as first-party evidence, not independent cost verification. No Apache, NVD, or third-party source reviewed for this profile audits the compute bill.
Future tracker rows are not imported automatically. Each still needs an affected-project source, fixed or accepted status, severity normalization, and an attribution label.
Why it matters
Striga is another signal that AI-assisted vulnerability discovery is moving into mainstream open-source infrastructure. The public evidence spans server software, developer tooling, desktop clients, and update paths, with several high-severity CVEs and detailed write-ups.
The Apache httpd credit is especially useful because it comes from the upstream project’s security advisory trail. It strengthens the Striga profile while still leaving the exact platform role honestly labeled.
Sources
- Striga homepage
- Striga CVE list
- Striga: Less than $100 of compute surfaces pre-auth RCE in Apache httpd
- Apache HTTP Server 2.4 vulnerabilities
- oss-security: CVE-2026-23918 Apache HTTP Server
- NVD: CVE-2026-23918
- Striga: Taking Down axios with a Single JSON Key
- Striga: The Help Button That Steals Your NTLM Hash
- Striga: Tomcat Tribes unauthenticated RCE
- Striga: Ollama Windows auto-update RCE