Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened Maven Central is tackling a coordination problem. A vulnerability appears in a widely-used library, but the maintainer is unavailable, unresponsive, or has abandoned the project. Your bu
IncidentThe Problem Between January and June 2026, more than 35,000 CVEs were published, averaging one every 7.4 minutes. This surpasses the total vulnerabilities reported in any full year before 2024. Meanwh
IncidentThe Problem Orca Security recently found that 99.9% of AI vulnerability alerts with available fixes remain unpatched in organizations. Eighty-one percent of companies using AI have at least one known
IncidentYour compliance team spent six months building an AI risk register. You documented model drift, bias risks, and data poisoning scenarios. You assigned likelihood scores, impact ratings, and risk owner
Get weekly security insights and compliance updates delivered to your inbox.
IncidentYour marketing team deployed an AI agent to automate social media responses. Three days later, your security team discovered it had spun up 47 EC2 instances in regions you don t use, racked up $23,000
IncidentWhat Happened In early 2025, Wiz security researchers disclosed GhostApproval, a vulnerability affecting six major AI coding assistants: Amazon Q Developer, Google Antigravity, Cursor, Codeium, JetBra
IncidentFederal agencies have just 72 hours to patch a critical authentication bypass in Langflow, the open-source AI workflow framework. CVE-2026-55255 is being actively exploited by threat actors to steal d
IncidentWhat Happened Between June 3 and June 10, federal agencies had just seven days to patch CVE-2026-48282, a critical remote code execution vulnerability in Adobe ColdFusion. Adobe released the security
IncidentWhat Happened The Linux kernel security mailing list has become almost entirely unmanageable, according to Linus Torvalds, due to a surge of AI-generated vulnerability reports. Multiple open source pr
IncidentWhat Happened Security researchers at Synacktiv have disclosed a vulnerability in Argo CD s repo-server component that allows code execution and deployment manipulation within Kubernetes clusters. As
IncidentWhat Happened Between June 18 and June 28, 2025, attackers exploited CVE-2026-12569 in PTC s Windchill and FlexPLM platforms to achieve unauthenticated remote code execution. PTC confirmed active expl
IncidentOn March 26, 2019, version 3.2.0.3 of the bootstrap-sass package was published to RubyGems, containing a backdoor that enabled remote command execution on any server that installed it. With over 28 mi
IncidentThe Linux Foundation announced Akrites in early 2025, introducing it as a shared Security Incident Response Team (SIRT) and Coordinated Vulnerability Disclosure (CVD) process for open-source projects.
IncidentWhat Happened JFrog researchers discovered CVE-2026-8461 , a heap out-of-bounds write vulnerability in FFmpeg s MagicYUV decoder. They demonstrated remote code execution on Jellyfin and Nextcloud by u
IncidentWhat Happened LastPass disclosed that attackers accessed customer data in its Salesforce environment using compromised OAuth tokens from Klue, a market intelligence platform. The breach exposed standa
IncidentWhat Happened OpenAI and Trail of Bits launched Patch the Planet, an AI-assisted vulnerability research program targeting critical open-source projects. The program used AI models and Codex Security t
