Expert perspectives on application security, compliance, and emerging threats
GeneralThe Conventional Wisdom Your compliance team demands audit trails for every AI agent action. They want logs detailing which agent made changes, why it chose specific dependency versions, and who appro
GeneralScope - What This Guide Covers This guide addresses agentic misalignment in AI systems—when models act against organizational goals or engage in self-preservation behaviors. You ll find implementation
IncidentIncident Overview Attackers compromised the node-ipc npm package by exploiting an expired domain linked to a maintainer s account. They published malicious versions (11.0.0, 11.1.0, and 12.0.0) contai
GuidesYou ve probably heard the advice: Just use Django s built-in protections or Static analysis will catch everything. These shortcuts sound efficient, but they re creating a generation of Python develope
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened On April 13, Microsoft rejected a security researcher s vulnerability report for Azure Backup for AKS (Azure Kubernetes Service). The researcher, Justin O Leary, identified a privilege e
DeadlinesThe EU s Cyber Resilience Act (CRA) introduces a new compliance requirement: software and network-connected products now need the same CE marking as electronics and machinery. By December 2027, if you
IncidentOn May 14, 2026, three malicious versions of node-ipc—a package with millions of weekly downloads—were published to npm. These versions (9.1.6, 9.2.3, and 12.0.1) contained a credential-stealing paylo
GeneralYour team just completed a SOC 2 Type II audit. You passed every control. Your spreadsheet shows 100% compliance with ISO 27001 . Yet last quarter, a developer accidentally pushed AWS credentials to a
IncidentWhat Happened TeamPCP compromised the Checkmarx Jenkins AST plugin in a second supply chain attack, using credentials obtained from an earlier breach. The attackers gained write access to the plugin s
GeneralThe belief that documenting AI components will control AI risk is widespread. CISA and the G7 have released guidance for AI software bills of materials (SBOMs), and the compliance world is treating it
IncidentWhat Happened SAP s May 2026 security updates addressed 15 vulnerabilities across its enterprise software portfolio. Two critical flaws stand out for their exploitability and potential impact: CVE-202
IncidentWhat Happened In early 2025, HackerOne paused its bug bounty program due to an overwhelming increase in vulnerability discoveries, driven by AI-assisted research. This wasn t a breach or technical fai
IncidentWhat Happened Cyera disclosed a critical heap out-of-bounds read vulnerability in Ollama, a popular open-source framework for running large language models locally. The flaw, tracked as CVE-2026-7482
GeneralScope - What This Guide Covers This guide focuses on data integrity controls for AI systems that inform business decisions. You ll find governance frameworks, implementation steps, and controls to pre
IncidentWhat Happened On March 23, 2026, malicious artifacts were published through a compromised Checkmarx GitHub repository. Seven days later, on March 30, attackers exfiltrated data from systems that had c
IncidentOn April 8, attackers compromised DAEMON Tools distribution infrastructure and replaced legitimate installers with trojanized versions. The attack continued through at least mid-April, affecting versi
