Expert perspectives on application security, compliance, and emerging threats
IncidentOn Monday, 37 organizations, including Nvidia, Palantir, and Hugging Face, announced the formation of the Open Secure AI Alliance. These companies are committed to developing tools and techniques for
IncidentWhat Happened In 2025, GitHub s public repositories exposed 28,649,024 new secrets, a 34% increase from the previous year. The root cause wasn t a single breach. It was systemic: AI-assisted developme
IncidentThe Challenge In late 2024, Anthropic s AI system Mythos showcased its ability to analyze codebases and identify vulnerabilities in minutes. This wasn t a breach, but it highlighted a critical issue:
IncidentOn a Thursday afternoon, CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog, giving federal agencies until Friday to patch. This vulnerability in Langflow, a low-code framework fo
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Between January 14 and February 12, 2025, WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 had a remote code execution vulnerability in the core REST API batch endpoint ( b
IncidentIn June 2024, OpenSSL released version 3.3.1 containing a fix for what Okta s security team later named HollowByte, a flaw that lets an attacker freeze server memory with minimal TLS requests. You wou
IncidentWhat Happened Between May and July 2026, attackers exploited CVE-2026-46817 , a critical Oracle E-Business Suite vulnerability that allows unauthenticated remote code execution. Oracle released a patc
IncidentWhen the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published new guidance on coordinated vulnerability disclosure programs in late 2024, it admitted its own reporting channels had f
IncidentWhat Happened Progress Software discovered a zero-day vulnerability in ShareFile Storage Zone Controllers and made an unusual decision: release patches immediately but delay the CVE publication for tw
IncidentWhat Happened Maven Central is tackling a coordination problem. A vulnerability appears in a widely-used library, but the maintainer is unavailable, unresponsive, or has abandoned the project. Your bu
IncidentThe Problem Between January and June 2026, more than 35,000 CVEs were published, averaging one every 7.4 minutes. This surpasses the total vulnerabilities reported in any full year before 2024. Meanwh
IncidentThe Problem Orca Security recently found that 99.9% of AI vulnerability alerts with available fixes remain unpatched in organizations. Eighty-one percent of companies using AI have at least one known
IncidentYour compliance team spent six months building an AI risk register. You documented model drift, bias risks, and data poisoning scenarios. You assigned likelihood scores, impact ratings, and risk owner
IncidentYour marketing team deployed an AI agent to automate social media responses. Three days later, your security team discovered it had spun up 47 EC2 instances in regions you don t use, racked up $23,000
IncidentWhat Happened In early 2025, Wiz security researchers disclosed GhostApproval, a vulnerability affecting six major AI coding assistants: Amazon Q Developer, Google Antigravity, Cursor, Codeium, JetBra
IncidentFederal agencies have just 72 hours to patch a critical authentication bypass in Langflow, the open-source AI workflow framework. CVE-2026-55255 is being actively exploited by threat actors to steal d
