Expert perspectives on application security, compliance, and emerging threats
GeneralThe assumption that you can secure AI in your applications just like open-source libraries—by scanning for vulnerabilities, checking licenses, and updating as needed—is dangerously incomplete. Why Tra
IncidentWhat Happened JFrog researchers discovered CVE-2026-8461 , a heap out-of-bounds write vulnerability in FFmpeg s MagicYUV decoder. They demonstrated remote code execution on Jellyfin and Nextcloud by u
IncidentWhat Happened LastPass disclosed that attackers accessed customer data in its Salesforce environment using compromised OAuth tokens from Klue, a market intelligence platform. The breach exposed standa
IncidentWhat Happened OpenAI and Trail of Bits launched Patch the Planet, an AI-assisted vulnerability research program targeting critical open-source projects. The program used AI models and Codex Security t
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened ShapedPlugin, a vendor of premium WordPress plugins, experienced a supply chain attack that injected backdoor code into official releases of multiple Pro plugins. This affected Product S
IncidentYour organization has just deployed its first AI agent into production. It authenticates through your existing identity provider (IdP), accesses your cloud storage, and queries your databases — the sa
ResearchAfter Zafran Security published their DifyTap research, compliance teams began questioning tenant isolation in multi-tenant AI platforms. This issue is not limited to Dify, which boasts over 146,000 G
IncidentA Zip Slip vulnerability in the Golang package go-rpmutils could have allowed attackers to write arbitrary files outside intended directories during archive extraction. The vulnerability, tracked as C
IncidentWhat Happened In 2020, researcher Yeting Li discovered a Regular Expression Denial of Service (REDoS) vulnerability in UAParser.js, a widely-used JavaScript library for parsing user agent strings. The
GeneralScope This guide addresses the governance of non-human identities (NHIs) — such as service accounts, API keys, OAuth tokens, machine certificates, and bot credentials — within compliance frameworks. Y
GeneralMany organizations mistakenly treat AI agents as mere software tools. They configure them once, rotate an API key occasionally, and assume they re secure. This approach is flawed and leads to security
GeneralScope This guide focuses on governance frameworks for AI-assisted code generation in organizations where employees use tools like Claude Code, GitHub Copilot, or ChatGPT to create applications outside
IncidentWhat Happened ShapedPlugin s distribution system was compromised, allowing attackers to inject malware into three premium WordPress plugins via the official update mechanism. The backdoor impersonated
StandardsThese questions come from compliance teams I ve talked to over the past six months. The new PCI DSS v4.0.1 requirements around payment-page scripts caught many organizations off guard. Requirement 6.4
IncidentImmediate Action Required for Federal Agencies The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-48907 to its Known Exploited Vulnerabilities Catalog, mandating federal ag
IncidentOn December 18, 2024, the European Commission proposed the Cybersecurity Act 2.0 (CSA 2.0). While intended to enhance security, the regulation introduces a vendor classification mechanism that uses ge
