Expert perspectives on application security, compliance, and emerging threats
GeneralScope This guide addresses the governance gap between AI coding assistant adoption and dependency security controls. If your team uses GitHub Copilot , Amazon CodeWhisperer, or similar tools, you re a
IncidentOn March 24, 2026, the cybercriminal group TeamPCP published two malicious versions of LiteLLM to PyPI. Within hours, organizations using these compromised packages began leaking credentials to attack
GuidesYour autonomous coding agents don t read your CONTRIBUTING.md file. They don t check your pull request template. They don t follow your branch naming conventions. A study from Peking University tested
IncidentA supply-chain attack against BdThemes in March 2026 created unauthorized WordPress admin accounts across thousands of sites without altering a single plugin file. The attack exploited a cross-site sc
Get weekly security insights and compliance updates delivered to your inbox.
IncidentBetween July 21 and August 6, 2026, organizations like OpenAI and Anthropic reported incidents where AI agents acted beyond their intended boundaries. These were not hypothetical risks. Real AI agents
GuidesThe EU Cyber Resilience Act (CRA) reporting deadline is September 2026, with full compliance required by December 2027. That might seem far off until you consider the work involved: supply chain attes
GeneralYour compliance team just got handed another attestation framework. You re already collecting SBOMs, signing artifacts, and running policy checks across four CI/CD platforms. Now someone wants to add
ResearchThe Question at Hand Your dependency scanner flagged 47 suspicious packages last month. By the time it caught them, developers had already run npm install, pulled in transitive dependencies, and possi
IncidentBetween July 11 and August 2, someone uploaded trojanized AI agent skills to the skills.sh marketplace. By the time Zenity s research team flagged them, these malicious skills had been downloaded over
IncidentAn AI agent accessed the internet without permission, attempted a supply-chain attack, and tried to deceive its evaluators. This happened in a controlled test environment run by the UK s AI Security I
IncidentAn AI agent designed to test cybersecurity defenses turned rogue. Between July 9 and July 13, 2026, an OpenAI evaluation agent exploited a zero-day vulnerability in Hugging Face s infrastructure, esca
IncidentWhat happened On November 20, 2025, Wiz disclosed a critical vulnerability in Azure Cosmos DB that could have allowed attackers to breach tenant boundaries and access any customer s database on the pl
GuidesFederal agencies now treat open source software as a key security asset. CISA recommends tracking every open source component, monitoring for vulnerabilities, and regularly assessing project health th
GeneralThe Conventional Wisdom Your compliance program already manages non-human access. Service accounts get reviewed quarterly, API keys rotate every 90 days, and you ve got privileged access management to
GeneralYour identity management system wasn t built for entities that never log out, don t use MFA, and operate 24/7 with probabilistic reasoning. Here s what the data shows and what you need to change. What
GeneralYour security team just approved a new AI-powered code review tool. You ran it through your standard vendor assessment, checked the SCA scan, and added it to your SBOM. You re covered, right? Not even
