Expert perspectives on application security, compliance, and emerging threats
GeneralYour AI system doesn t ship with a parts list. That s the problem. When you deploy a containerized application, you generate an SBOM showing every library, version, and dependency. When you deploy an
IncidentIncident Overview On April 22, attackers published a malicious version of the Bitwarden CLI package to npm. This compromised package was available for about 90 minutes before it was detected and remov
GeneralThe European Cyber Resilience Act (CRA) became enforceable in December 2024, yet awareness is declining. A recent survey found that 66% of respondents remain unfamiliar with the CRA—up from 62% earlie
IncidentWhat Happened Between late March and early April 2025, attackers began exploiting CVE-2026-42945 , a critical vulnerability in NGINX that allows denial-of-service attacks and potential remote code exe
Get weekly security insights and compliance updates delivered to your inbox.
GeneralThe Conventional Wisdom Your compliance team demands audit trails for every AI agent action. They want logs detailing which agent made changes, why it chose specific dependency versions, and who appro
GeneralScope - What This Guide Covers This guide addresses agentic misalignment in AI systems—when models act against organizational goals or engage in self-preservation behaviors. You ll find implementation
IncidentIncident Overview Attackers compromised the node-ipc npm package by exploiting an expired domain linked to a maintainer s account. They published malicious versions (11.0.0, 11.1.0, and 12.0.0) contai
GuidesYou ve probably heard the advice: Just use Django s built-in protections or Static analysis will catch everything. These shortcuts sound efficient, but they re creating a generation of Python develope
IncidentWhat Happened On April 13, Microsoft rejected a security researcher s vulnerability report for Azure Backup for AKS (Azure Kubernetes Service). The researcher, Justin O Leary, identified a privilege e
DeadlinesThe EU s Cyber Resilience Act (CRA) introduces a new compliance requirement: software and network-connected products now need the same CE marking as electronics and machinery. By December 2027, if you
IncidentOn May 14, 2026, three malicious versions of node-ipc—a package with millions of weekly downloads—were published to npm. These versions (9.1.6, 9.2.3, and 12.0.1) contained a credential-stealing paylo
GeneralYour team just completed a SOC 2 Type II audit. You passed every control. Your spreadsheet shows 100% compliance with ISO 27001 . Yet last quarter, a developer accidentally pushed AWS credentials to a
IncidentWhat Happened TeamPCP compromised the Checkmarx Jenkins AST plugin in a second supply chain attack, using credentials obtained from an earlier breach. The attackers gained write access to the plugin s
GeneralThe belief that documenting AI components will control AI risk is widespread. CISA and the G7 have released guidance for AI software bills of materials (SBOMs), and the compliance world is treating it
IncidentWhat Happened SAP s May 2026 security updates addressed 15 vulnerabilities across its enterprise software portfolio. Two critical flaws stand out for their exploitability and potential impact: CVE-202
IncidentWhat Happened In early 2025, HackerOne paused its bug bounty program due to an overwhelming increase in vulnerability discoveries, driven by AI-assisted research. This wasn t a breach or technical fai
