Expert perspectives on application security, compliance, and emerging threats
IncidentThe Australian Federal Police charged two men with 14 offenses tied to TeamPCP, a cybercrime group that compromised multiple open-source security tools to distribute malware through trusted channels.
IncidentOn February 5, 2025, Sonatype published advisory sonatype-2026-006746 about a technique bypassing Log4j s FilteredObjectInputStream deserialization control. They didn t assign it a CVE, and Apache did
DeadlinesYour company probably isn t ready for the Cyber Resilience Act (CRA). According to recent research, 66% of the global software community hasn t heard of the CRA, with North American teams hitting 72%
IncidentWhat Happened On January 21, 2026, Oracle released patches for CVE-2026-21962 , a vulnerability in WebLogic Server with a perfect 10.0 CVSS score. This flaw allows attackers to access and modify criti
Get weekly security insights and compliance updates delivered to your inbox.
StandardsThe Second NIST Cyber AI Profile Workshop highlighted a key issue in AI governance: the disconnect between enterprise-level policy and the engineers tasked with implementation. The Challenge NIST s Pr
GeneralYour team just got asked to support AI agents that use Model Context Protocol (MCP). You ve got hundreds of existing APIs. Now what? This guide walks through the technical decisions you ll face when i
ResearchYou ve likely seen the pitch: AI will transform your vulnerability management, speed up triage, and catch threats before humans can. What vendors don t mention is that adding AI to a flawed security m
IncidentWhat Happened A mid-sized financial services company deployed an AI-powered vulnerability scanning tool in July to support their SOC 2 Type II recertification. The tool integrated with their CI/CD pip
ResearchAbout six months ago, questions started popping up in our Slack channel. An engineer asked about ChatGPT usage policies. Another wondered how to scan AI-generated pull requests. Recently, a compliance
IncidentNearly one in three organizations experienced an API breach in the past 12 months. If you re assuming your WAF caught everything, you re using the wrong security model. What Happened Organizations rel
GeneralThe conventional wisdom: AI agents should understand user context and enforce access controls themselves. If an agent is going to retrieve data on behalf of users, it needs to know who those users are
IncidentWhat Happened On January 29, 2025, GitLab released patches for CVE-2026-19478, a critical vulnerability with a CVSS score of 9.4. The flaw affects GitLab versions 18.2 before 18.11.11, 19.0 before 19.
GeneralYou ve built a fortress. Your most sensitive systems sit behind an air gap, physically isolated from the internet. No inbound connections, no outbound data leaks, no remote attacks. The compliance box
DeadlinesIf you re shipping products to the EU and using open source components, you have until September 2026 to comply with the European Cyber Resilience Act (CRA). Here s the issue: 66% of organizations are
IncidentYour vendor management program looked solid on paper. You had a questionnaire, reviewed SOC 2 reports annually, and checked the compliance boxes. Then a third-party incident hit, and you re facing a $
IncidentWhat Happened The Axios npm package, downloaded 100 million times weekly, was compromised with a backdoor. The attack deployed WAVESHAPER.V2, a remote access trojan that exfiltrated developer secrets
