Expert perspectives on application security, compliance, and emerging threats
IncidentA critical vulnerability in Adobe Commerce and Magento Open Source reached a perfect CVSS score of 10.0 before most teams even knew they were exposed. CVE-2026-75650, dubbed StyleSmuggler, was exploit
IncidentThe Problem with AI-Driven Vulnerability Detection Anthropic s Claude Mythos Preview scanned 281 open-source projects and identified 23,019 potential vulnerabilities. External security firms reviewed
IncidentWhat Happened The Shai-Hulud infostealer worm has expanded its credential harvesting from 189 to 469 locations in developer environments, as reported by GitGuardian. This isn t a new threat actor or t
IncidentOn July 8, 2026, the Open Source Geospatial Foundation (OSGeo) released GeoNetwork versions 4.4.12 and 4.2.17 to fix two vulnerabilities that, when combined, allow unauthenticated remote code executio
Get weekly security insights and compliance updates delivered to your inbox.
IncidentThe Challenge AI-powered tools have drastically sped up vulnerability discovery, reducing a 60-day research process to just four hours. Major vendors now use models from Anthropic and OpenAI to identi
IncidentWhat Happened On August 27, 2026, ServiceNow disclosed four vulnerabilities in its AI Platform, with three rated at the highest severity level, CVSS 10.0. These flaws allow attackers to execute arbitr
IncidentThe Threat Landscape In 2025, financial services organizations blocked 893 malicious packages from entering their development environments. By mid-2026, they d intercepted 572 more. These packages wer
IncidentThe Australian Federal Police charged two men with 14 offenses tied to TeamPCP, a cybercrime group that compromised multiple open-source security tools to distribute malware through trusted channels.
IncidentOn February 5, 2025, Sonatype published advisory sonatype-2026-006746 about a technique bypassing Log4j s FilteredObjectInputStream deserialization control. They didn t assign it a CVE, and Apache did
IncidentWhat Happened On January 21, 2026, Oracle released patches for CVE-2026-21962 , a vulnerability in WebLogic Server with a perfect 10.0 CVSS score. This flaw allows attackers to access and modify criti
IncidentWhat Happened A mid-sized financial services company deployed an AI-powered vulnerability scanning tool in July to support their SOC 2 Type II recertification. The tool integrated with their CI/CD pip
IncidentNearly one in three organizations experienced an API breach in the past 12 months. If you re assuming your WAF caught everything, you re using the wrong security model. What Happened Organizations rel
IncidentWhat Happened On January 29, 2025, GitLab released patches for CVE-2026-19478, a critical vulnerability with a CVSS score of 9.4. The flaw affects GitLab versions 18.2 before 18.11.11, 19.0 before 19.
IncidentYour vendor management program looked solid on paper. You had a questionnaire, reviewed SOC 2 reports annually, and checked the compliance boxes. Then a third-party incident hit, and you re facing a $
IncidentWhat Happened The Axios npm package, downloaded 100 million times weekly, was compromised with a backdoor. The attack deployed WAVESHAPER.V2, a remote access trojan that exfiltrated developer secrets
IncidentOn March 24, 2026, the cybercriminal group TeamPCP published two malicious versions of LiteLLM to PyPI. Within hours, organizations using these compromised packages began leaking credentials to attack
