Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened In December 2021, a critical vulnerability in Apache Log4j—a widely used Java logging library—allowed attackers to execute arbitrary code on vulnerable systems. This exploit, known as CV
IncidentWhat Happened Between late 2025 and June 11, 2026, attackers executed a supply chain attack against the Arch User Repository (AUR). They adopted orphaned packages—projects whose original maintainers h
GuidesYour AI agents need identity records just like your employees do. However, many security teams still track them in spreadsheets or, worse, don t track them at all. When an agent holds API keys to your
IncidentOn March 15, 2022, thousands of developers running npm install unknowingly pulled malicious code into their projects. The maintainer of node-ipc—a widely-used inter-process communication library—intro
Get weekly security insights and compliance updates delivered to your inbox.
ResearchThe Challenge Your development team has boosted sprint velocity by 40%. Code moves from developer workstations to production faster than ever. Pull requests that once took days now close in hours. The
IncidentSummary of Events For over 15 years, npm allowed packages to execute arbitrary code during installation through preinstall, install, and postinstall scripts. These scripts ran automatically whenever a
IncidentOn March 30, 2022, researchers disclosed CVE-2022-22965, a critical remote code execution vulnerability in the Spring Framework. Within hours, proof-of-concept exploits circulated publicly. If your te
GeneralWhen OpenAI announced Lockdown Mode, many compliance teams felt relieved. Finally, a vendor-provided control to prevent sensitive data leaks through AI interactions. However, this relief is premature.
GeneralScope - What This Guide Covers This guide addresses the risks of end-of-life (EOL) open source dependencies in commercial applications. You ll learn how to identify EOL components, assess compliance i
IncidentThe Discovery GitGuardian s analysis revealed an average of 150 secrets per developer machine. These secrets weren t found in repositories or CI/CD logs but on local workstations — hidden in shell his
IncidentSummary of the Incident A single unpatched VPN vulnerability in Marquis Software s platform compromised over seventy financial institutions. This vulnerability was present in the production infrastruc
StandardsThe National Vulnerability Database backlog isn t just NIST s problem—it s yours. When the OIG found that analysts severity calculations matched NIST s only 12% of the time, they exposed a systemic is
IncidentWhat Happened Hola Browser s Windows distribution was compromised through its software supply chain, resulting in a cryptocurrency miner being bundled with legitimate installations. The malicious exec
IncidentWhat Happened On January 8, 2025, CISA added CVE-2024-21182 to its Known Exploited Vulnerabilities catalog. This vulnerability affects Oracle WebLogic Server and allows remote code execution. Oracle r
IncidentIncident Overview The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-21182 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch Oracle WebLogic S
GuidesPurpose of the Template Your dependency management policy must be robust to prevent the next supply chain incident from affecting your production environment. This template establishes governance cont
