Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened The Linux kernel security mailing list has become almost entirely unmanageable, according to Linus Torvalds, due to a surge of AI-generated vulnerability reports. Multiple open source pr
GeneralAI spending is projected to reach $2.5 trillion by 2026, with 40% of enterprise applications embedding task-specific AI agents by the end of that year. However, many organizations grant these agents m
ResearchYour compliance team is hearing the same message from every business unit: deploy AI faster. But when you ask about security controls, threat models, or data governance, you get blank stares. This gap
ResearchThese myths persist because they allow teams to avoid uncomfortable conversations about accountability. When your auditor asks who owns security for the 247 open source packages in your application, p
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Security researchers at Synacktiv have disclosed a vulnerability in Argo CD s repo-server component that allows code execution and deployment manipulation within Kubernetes clusters. As
IncidentWhat Happened Between June 18 and June 28, 2025, attackers exploited CVE-2026-12569 in PTC s Windchill and FlexPLM platforms to achieve unauthenticated remote code execution. PTC confirmed active expl
IncidentOn March 26, 2019, version 3.2.0.3 of the bootstrap-sass package was published to RubyGems, containing a backdoor that enabled remote command execution on any server that installed it. With over 28 mi
GuidesThe PCI Software Security Framework (launched January 2019) now requires continuous security monitoring of open source components in payment software. This is not just a checkbox exercise—it s a funda
GeneralYou re maintaining a payment processing service that depends on 247 open source packages. Eighteen of them haven t seen a commit in over two years. Three have known CVEs with no patches coming. Your c
DeadlinesThe proposed AI Incident Reporting Act mandates that developers of advanced AI models report major safety and security incidents to the Commerce Department within seven days of discovery. With civil p
IncidentThe Linux Foundation announced Akrites in early 2025, introducing it as a shared Security Incident Response Team (SIRT) and Coordinated Vulnerability Disclosure (CVD) process for open-source projects.
GeneralThe assumption that you can secure AI in your applications just like open-source libraries—by scanning for vulnerabilities, checking licenses, and updating as needed—is dangerously incomplete. Why Tra
IncidentWhat Happened JFrog researchers discovered CVE-2026-8461 , a heap out-of-bounds write vulnerability in FFmpeg s MagicYUV decoder. They demonstrated remote code execution on Jellyfin and Nextcloud by u
IncidentWhat Happened LastPass disclosed that attackers accessed customer data in its Salesforce environment using compromised OAuth tokens from Klue, a market intelligence platform. The breach exposed standa
IncidentWhat Happened OpenAI and Trail of Bits launched Patch the Planet, an AI-assisted vulnerability research program targeting critical open-source projects. The program used AI models and Codex Security t
IncidentWhat Happened ShapedPlugin, a vendor of premium WordPress plugins, experienced a supply chain attack that injected backdoor code into official releases of multiple Pro plugins. This affected Product S
