Expert perspectives on application security, compliance, and emerging threats
GeneralYou ve got three years before the Cyber Resilience Act makes Software Bills of Materials (SBOMs) mandatory in Europe. That deadline is at the end of 2027, and if you re selling software into EU market
IncidentIn June 2024, OpenSSL released version 3.3.1 containing a fix for what Okta s security team later named HollowByte, a flaw that lets an attacker freeze server memory with minimal TLS requests. You wou
IncidentWhat Happened Between May and July 2026, attackers exploited CVE-2026-46817 , a critical Oracle E-Business Suite vulnerability that allows unauthenticated remote code execution. Oracle released a patc
IncidentWhen the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published new guidance on coordinated vulnerability disclosure programs in late 2024, it admitted its own reporting channels had f
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Progress Software discovered a zero-day vulnerability in ShareFile Storage Zone Controllers and made an unusual decision: release patches immediately but delay the CVE publication for tw
ResearchRethinking Vulnerability Disclosure Many security teams treat vulnerability disclosure as a mere compliance task. You might post a security.txt file, set up a [email protected] email that routes to
GeneralYou ve filled out the framework mapping spreadsheet. You ve documented your model card. You ve assigned risk tiers to your AI systems. And now you think you re done with AI governance. Here s the prob
IncidentWhat Happened Maven Central is tackling a coordination problem. A vulnerability appears in a widely-used library, but the maintainer is unavailable, unresponsive, or has abandoned the project. Your bu
ResearchYour team just adopted an AI coding assistant. You ve reviewed the privacy settings, turned off model training, and assumed you re protected. Meanwhile, the tool is uploading your entire Git history t
IncidentThe Problem Between January and June 2026, more than 35,000 CVEs were published, averaging one every 7.4 minutes. This surpasses the total vulnerabilities reported in any full year before 2024. Meanwh
IncidentThe Problem Orca Security recently found that 99.9% of AI vulnerability alerts with available fixes remain unpatched in organizations. Eighty-one percent of companies using AI have at least one known
IncidentYour compliance team spent six months building an AI risk register. You documented model drift, bias risks, and data poisoning scenarios. You assigned likelihood scores, impact ratings, and risk owner
IncidentYour marketing team deployed an AI agent to automate social media responses. Three days later, your security team discovered it had spun up 47 EC2 instances in regions you don t use, racked up $23,000
IncidentWhat Happened In early 2025, Wiz security researchers disclosed GhostApproval, a vulnerability affecting six major AI coding assistants: Amazon Q Developer, Google Antigravity, Cursor, Codeium, JetBra
ResearchThe Challenge Your compliance team just finished mapping your organization s software dependencies. The audit revealed something uncomfortable: seventeen of your critical libraries are maintained by s
IncidentFederal agencies have just 72 hours to patch a critical authentication bypass in Langflow, the open-source AI workflow framework. CVE-2026-55255 is being actively exploited by threat actors to steal d
