Expert perspectives on application security, compliance, and emerging threats
ResearchFive days after PHP2Shell disclosure, 93.6% of PHP systems remained vulnerable due to common patching mistakes that hinder swift remediation.
IncidentA critical memory-corruption flaw in Google's Brotli decoder led to over 50 patches across platforms, exposing challenges in managing bundled open-source dependencies.
IncidentWhat Happened The PCI Security Standards Council issued emergency guidance after finding that organizations were using AI systems to process cardholder data without human oversight. While no specific
IncidentWhat Happened A mid-sized software vendor selling IoT devices in the EU market discovered an actively exploited vulnerability in their product line. Their security team followed their standard process
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened On September 22, WordPress released version 7.1.2 to patch CVE-2026-87902 , a critical remote code execution vulnerability discovered by security researcher Robert Ressel. This flaw affe
GeneralThe EU Cyber Resilience Act s first major deadline is September 11, 2026. If you re reading this in mid-2024 or later, you ve got about 24 months to figure out where your organization fits in the comp
GuidesThe EU Cyber Resilience Act (CRA) imposes a five-year vulnerability management obligation on manufacturers using open source components in their products. If your team builds commercial software with
IncidentA critical vulnerability in Adobe Commerce and Magento Open Source reached a perfect CVSS score of 10.0 before most teams even knew they were exposed. CVE-2026-75650, dubbed StyleSmuggler, was exploit
IncidentThe Problem with AI-Driven Vulnerability Detection Anthropic s Claude Mythos Preview scanned 281 open-source projects and identified 23,019 potential vulnerabilities. External security firms reviewed
DeadlinesThe EU Cyber Resilience Act came into force in December 2024. By September 11, 2026, your team must report actively exploited vulnerabilities within 24 hours of awareness. That s right, just 24 hours.
IncidentWhat Happened The Shai-Hulud infostealer worm has expanded its credential harvesting from 189 to 469 locations in developer environments, as reported by GitGuardian. This isn t a new threat actor or t
IncidentOn July 8, 2026, the Open Source Geospatial Foundation (OSGeo) released GeoNetwork versions 4.4.12 and 4.2.17 to fix two vulnerabilities that, when combined, allow unauthenticated remote code executio
IncidentThe Challenge AI-powered tools have drastically sped up vulnerability discovery, reducing a 60-day research process to just four hours. Major vendors now use models from Anthropic and OpenAI to identi
GeneralYour engineering team is shipping features with AI models they found on Hugging Face. Your data science group is testing LLMs through third-party APIs. Your support team just integrated a chatbot some
StandardsYou re facing a decision: your organization is deploying LLMs, and you need to secure them. The OWASP LLM AI Cybersecurity Governance Checklist offers a structured six-step approach to LLM strategy. B
GeneralScope This guide focuses on identity-based security controls for AI agents that autonomously execute code, move data, and provision infrastructure. You ll learn how to implement lifecycle governance f
