Expert perspectives on application security, compliance, and emerging threats
GuidesThe EU Cyber Resilience Act becomes applicable in December 2027. If you sell software products in the EU, you need verifiable Software Bills of Materials (SBOMs) for everything you ship. These must be
IncidentOn a Friday evening in late 2024, websites using OptinMonster began serving malicious JavaScript to visitors. The attack originated from a compromised content delivery network (CDN), not OptinMonster
GuidesYour logging infrastructure was built for humans clicking buttons. Now you have AI agents making API calls, and your auditor wants to know who authorized what. This template provides a structured audi
IncidentWhat Happened The Federal Trade Commission (FTC) issued a public warning to companies: if you fail to protect consumer data from exposure due to Log4j vulnerabilities, they will pursue legal action. T
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn January 9, 2022, developers worldwide faced a sudden disruption: their builds were broken. This wasn t due to a zero-day exploit or a sophisticated supply chain attack, but rather a maintainer inte
IncidentWhat Happened In December 2021, a critical vulnerability in Apache Log4j—a widely used Java logging library—allowed attackers to execute arbitrary code on vulnerable systems. This exploit, known as CV
IncidentWhat Happened Between late 2025 and June 11, 2026, attackers executed a supply chain attack against the Arch User Repository (AUR). They adopted orphaned packages—projects whose original maintainers h
GuidesYour AI agents need identity records just like your employees do. However, many security teams still track them in spreadsheets or, worse, don t track them at all. When an agent holds API keys to your
IncidentOn March 15, 2022, thousands of developers running npm install unknowingly pulled malicious code into their projects. The maintainer of node-ipc—a widely-used inter-process communication library—intro
ResearchThe Challenge Your development team has boosted sprint velocity by 40%. Code moves from developer workstations to production faster than ever. Pull requests that once took days now close in hours. The
IncidentSummary of Events For over 15 years, npm allowed packages to execute arbitrary code during installation through preinstall, install, and postinstall scripts. These scripts ran automatically whenever a
IncidentOn March 30, 2022, researchers disclosed CVE-2022-22965, a critical remote code execution vulnerability in the Spring Framework. Within hours, proof-of-concept exploits circulated publicly. If your te
GeneralWhen OpenAI announced Lockdown Mode, many compliance teams felt relieved. Finally, a vendor-provided control to prevent sensitive data leaks through AI interactions. However, this relief is premature.
GeneralScope - What This Guide Covers This guide addresses the risks of end-of-life (EOL) open source dependencies in commercial applications. You ll learn how to identify EOL components, assess compliance i
IncidentThe Discovery GitGuardian s analysis revealed an average of 150 secrets per developer machine. These secrets weren t found in repositories or CI/CD logs but on local workstations — hidden in shell his
IncidentSummary of the Incident A single unpatched VPN vulnerability in Marquis Software s platform compromised over seventy financial institutions. This vulnerability was present in the production infrastruc
