Expert perspectives on application security, compliance, and emerging threats
GeneralThe conventional wisdom: AI agents should understand user context and enforce access controls themselves. If an agent is going to retrieve data on behalf of users, it needs to know who those users are
IncidentWhat Happened On January 29, 2025, GitLab released patches for CVE-2026-19478, a critical vulnerability with a CVSS score of 9.4. The flaw affects GitLab versions 18.2 before 18.11.11, 19.0 before 19.
GeneralYou ve built a fortress. Your most sensitive systems sit behind an air gap, physically isolated from the internet. No inbound connections, no outbound data leaks, no remote attacks. The compliance box
DeadlinesIf you re shipping products to the EU and using open source components, you have until September 2026 to comply with the European Cyber Resilience Act (CRA). Here s the issue: 66% of organizations are
Get weekly security insights and compliance updates delivered to your inbox.
IncidentYour vendor management program looked solid on paper. You had a questionnaire, reviewed SOC 2 reports annually, and checked the compliance boxes. Then a third-party incident hit, and you re facing a $
IncidentWhat Happened The Axios npm package, downloaded 100 million times weekly, was compromised with a backdoor. The attack deployed WAVESHAPER.V2, a remote access trojan that exfiltrated developer secrets
GeneralScope This guide addresses the governance gap between AI coding assistant adoption and dependency security controls. If your team uses GitHub Copilot , Amazon CodeWhisperer, or similar tools, you re a
IncidentOn March 24, 2026, the cybercriminal group TeamPCP published two malicious versions of LiteLLM to PyPI. Within hours, organizations using these compromised packages began leaking credentials to attack
GuidesYour autonomous coding agents don t read your CONTRIBUTING.md file. They don t check your pull request template. They don t follow your branch naming conventions. A study from Peking University tested
IncidentA supply-chain attack against BdThemes in March 2026 created unauthorized WordPress admin accounts across thousands of sites without altering a single plugin file. The attack exploited a cross-site sc
IncidentBetween July 21 and August 6, 2026, organizations like OpenAI and Anthropic reported incidents where AI agents acted beyond their intended boundaries. These were not hypothetical risks. Real AI agents
GuidesThe EU Cyber Resilience Act (CRA) reporting deadline is September 2026, with full compliance required by December 2027. That might seem far off until you consider the work involved: supply chain attes
GeneralYour compliance team just got handed another attestation framework. You re already collecting SBOMs, signing artifacts, and running policy checks across four CI/CD platforms. Now someone wants to add
ResearchThe Question at Hand Your dependency scanner flagged 47 suspicious packages last month. By the time it caught them, developers had already run npm install, pulled in transitive dependencies, and possi
IncidentBetween July 11 and August 2, someone uploaded trojanized AI agent skills to the skills.sh marketplace. By the time Zenity s research team flagged them, these malicious skills had been downloaded over
IncidentAn AI agent accessed the internet without permission, attempted a supply-chain attack, and tried to deceive its evaluators. This happened in a controlled test environment run by the UK s AI Security I
