Expert perspectives on application security, compliance, and emerging threats
GeneralYour static analysis tools scanned clean. Your code review passed. Your deployment went live. And somewhere in a shopper s browser, a payment skimmer just activated from metadata hidden inside a favic
GeneralThe Conventional Wisdom Your compliance team needs an SBOM. The EU Cyber Resilience Act demands it. Executive Order 14028 requires it. Every vendor pitch deck promises that generating and managing Sof
GeneralDebian developers recently voted to encourage, but not require, disclosure of AI assistance in code contributions. The decision was to make disclosure voluntary, with mandatory human review of AI-gene
DeadlinesIf proposed legislation requires you to throttle, suspend, or shut down AI agents, you ll need more than a big red button. You ll need documented policies, tested procedures, and clear authority chain
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened On August 27, 2026, ServiceNow disclosed four vulnerabilities in its AI Platform, with three rated at the highest severity level, CVSS 10.0. These flaws allow attackers to execute arbitr
IncidentThe Threat Landscape In 2025, financial services organizations blocked 893 malicious packages from entering their development environments. By mid-2026, they d intercepted 572 more. These packages wer
IncidentThe Australian Federal Police charged two men with 14 offenses tied to TeamPCP, a cybercrime group that compromised multiple open-source security tools to distribute malware through trusted channels.
IncidentOn February 5, 2025, Sonatype published advisory sonatype-2026-006746 about a technique bypassing Log4j s FilteredObjectInputStream deserialization control. They didn t assign it a CVE, and Apache did
DeadlinesYour company probably isn t ready for the Cyber Resilience Act (CRA). According to recent research, 66% of the global software community hasn t heard of the CRA, with North American teams hitting 72%
IncidentWhat Happened On January 21, 2026, Oracle released patches for CVE-2026-21962 , a vulnerability in WebLogic Server with a perfect 10.0 CVSS score. This flaw allows attackers to access and modify criti
StandardsThe Second NIST Cyber AI Profile Workshop highlighted a key issue in AI governance: the disconnect between enterprise-level policy and the engineers tasked with implementation. The Challenge NIST s Pr
GeneralYour team just got asked to support AI agents that use Model Context Protocol (MCP). You ve got hundreds of existing APIs. Now what? This guide walks through the technical decisions you ll face when i
ResearchYou ve likely seen the pitch: AI will transform your vulnerability management, speed up triage, and catch threats before humans can. What vendors don t mention is that adding AI to a flawed security m
IncidentWhat Happened A mid-sized financial services company deployed an AI-powered vulnerability scanning tool in July to support their SOC 2 Type II recertification. The tool integrated with their CI/CD pip
ResearchAbout six months ago, questions started popping up in our Slack channel. An engineer asked about ChatGPT usage policies. Another wondered how to scan AI-generated pull requests. Recently, a compliance
IncidentNearly one in three organizations experienced an API breach in the past 12 months. If you re assuming your WAF caught everything, you re using the wrong security model. What Happened Organizations rel
