Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened In 2025, GitHub s public repositories exposed 28,649,024 new secrets, a 34% increase from the previous year. The root cause wasn t a single breach. It was systemic: AI-assisted developme
ResearchScope This guide covers how to identify and prioritize security-relevant code changes that ship without CVE assignments or security advisories. You ll learn to build a process that catches exploitable
GeneralMost discussions about AI coding tools focus on whether the generated code is secure. That s the wrong question. The real risk isn t what the AI writes at the moment, it s what it pulls in from the ec
GeneralScope This guide tackles the challenge of ensuring your AI agents perform precisely as instructed, without deviation. If your team deploys AI systems that act on behalf of users, like booking resource
Get weekly security insights and compliance updates delivered to your inbox.
GeneralYou ve probably heard the pitch: AI coding assistants will make your developers more productive, catch bugs earlier, and ship features faster. All true. What the vendor demos won t show you is what ha
GeneralCompliance teams at regulated organizations often hear that AI will revolutionize development speed. What they re thinking: Great, another technology that ll create audit findings. This skepticism isn
IncidentThe Challenge In late 2024, Anthropic s AI system Mythos showcased its ability to analyze codebases and identify vulnerabilities in minutes. This wasn t a breach, but it highlighted a critical issue:
IncidentOn a Thursday afternoon, CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog, giving federal agencies until Friday to patch. This vulnerability in Langflow, a low-code framework fo
IncidentWhat Happened Between January 14 and February 12, 2025, WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 had a remote code execution vulnerability in the core REST API batch endpoint ( b
ResearchPurpose of the Template Your Third-Party Notices (TPNs) likely sit in a compliance folder as a lengthy PDF with inconsistent formatting. While they re generated for legal reasons, they don t contribut
GuidesYour software bill of materials (SBOM) might be sitting in a PDF somewhere, listing every dependency your application uses. It s technically accurate, but it s useless when a new vulnerability emerges
GeneralYou ve got three years before the Cyber Resilience Act makes Software Bills of Materials (SBOMs) mandatory in Europe. That deadline is at the end of 2027, and if you re selling software into EU market
IncidentIn June 2024, OpenSSL released version 3.3.1 containing a fix for what Okta s security team later named HollowByte, a flaw that lets an attacker freeze server memory with minimal TLS requests. You wou
IncidentWhat Happened Between May and July 2026, attackers exploited CVE-2026-46817 , a critical Oracle E-Business Suite vulnerability that allows unauthenticated remote code execution. Oracle released a patc
IncidentWhen the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published new guidance on coordinated vulnerability disclosure programs in late 2024, it admitted its own reporting channels had f
IncidentWhat Happened Progress Software discovered a zero-day vulnerability in ShareFile Storage Zone Controllers and made an unusual decision: release patches immediately but delay the CVE publication for tw
