Expert perspectives on application security, compliance, and emerging threats
StandardsStarting April 15, NIST will stop enriching and scoring lower-priority vulnerabilities. Submission volumes grew 263% while NIST enriched 42,000 CVEs in 2025 — they can t keep up. If your vulnerability
StandardsYour PHP applications rely on Composer . If you re running versions between 2.0 and 2.2.27 or between 2.3 and 2.9.6, you are exposed to command injection vulnerabilities in your dependency management
StandardsScope - What This Guide Covers With NIST reducing its role in CVE data enrichment, your vulnerability management program must adapt. This guide details the changes, their impact, and the necessary adj
StandardsNIST enriched nearly 42,000 CVEs in 2025, a 45% increase over previous years. Yet they just announced they re scaling back. Why? CVE submissions jumped 263% between 2020 and 2025, and the old model of
Get weekly security insights and compliance updates delivered to your inbox.
StandardsI ve been fielding urgent questions about CVE-2026-40478 in Thymeleaf. Many teams using Java Spring apps with Thymeleaf are now facing a 9.1 CVSS vulnerability that allows unauthenticated attackers to
StandardsWhen Socket alerted on malicious Docker images in the official checkmarx/kics repository—including a new tag v2.1.21—and compromised VS Code extensions (checkmarx/ [email protected] and 1.19.0), se
StandardsYour team just deployed an AI agent to automate incident response. It needs to query your SIEM, update tickets, and potentially disable compromised accounts. The question you re facing: how do you gra
StandardsYour open-source project just received an email from someone claiming to be a core maintainer, asking for elevated repository access. The writing style matches, and the email domain looks legitimate,
StandardsScope - What This Guide Covers This guide defines security responsibilities for teams deploying AI systems from third-party vendors. It addresses: Which security controls belong to your team vs. the v
StandardsYou ve seen the reports. NIST has changed the way it prioritizes software flaws in its CVE framework. The shift is clear: focus on high-impact vulnerabilities, not just volume. This isn t about abando
StandardsOver the past month, I ve encountered the same set of questions in multiple forums, all centering on Anthropic s Claude Mythos—an AI model that claims to find and weaponize vulnerabilities at an unpre
StandardsThe Telnyx SDK compromise on PyPI presents your security team with a critical decision: do you restrict package installation at the perimeter, or do you allow flexibility and invest in runtime detecti
StandardsThe Challenge Your platform engineering team might be managing multiple Kubernetes clusters across various environments. A common issue is policy chaos. One team adopted Kyverno as their policy engine
StandardsThese questions arise from recent experiences with contractors navigating the implications of the Cybersecurity Maturity Model Certification (CMMC) for their supplier relationships. With the Departmen
StandardsThe Challenge Security scanning tools often generate excessive noise. Your team is likely familiar with this issue. A typical enterprise application security (AppSec) program runs static application s
StandardsYour AI coding assistant just suggested a library. Your developer accepted it. Your codebase now includes a new dependency with 47 transitive dependencies, three of which have known CVEs. This happene
