Expert perspectives on application security, compliance, and emerging threats
ResearchYour build just failed. Someone on the team installed a package that looked legitimate but turned out to be malware. Now you re fielding questions in three different Slack channels while trying to fig
GeneralThe traditional Continuous Integration (CI) pipeline was designed for a time when developers pushed code a few times per day. However, coding agents operate differently, iterating in seconds rather th
ResearchThe Node-IPC compromise (versions 9.1.6, 9.2.3, and 12.0.1) revealed a critical oversight: attackers are now creating infrastructure-aware operations that map your cloud environment, wait for specific
GuidesYour coding agent just modified three microservices, updated a Helm chart, and pushed changes to staging. Did it work? In a traditional monolithic app, you d run the test suite and know within seconds
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn February 28, 2025, security researchers at Endor Labs discovered that attackers had published malicious versions of popular JavaScript packages—including TanStack Query and Mistral AI s SDK—using s
IncidentOn May 9, 2026, Checkmarx published a malicious version of its Jenkins AST plugin to the public Jenkins plugin repository. This compromised version was designed to exfiltrate user credentials and pote
GeneralYour team runs 50 Kubernetes clusters. Next quarter, you ll run 200. The year after, maybe 1,000. At some point, the management approach that got you here stops working—but most teams don t realize wh
IncidentWhat Happened In 2024, TeamPCP compromised the Trivy vulnerability scanner, an open-source tool used by many organizations to detect security issues in containers and dependencies. The attackers publi
IncidentIncident Overview On March 23, 2026, an attacker published malicious versions of two Checkmarx plugins to the OpenVSX registry: ast-results-2.53.0.vsix and cx-dev-assist-1.7.0.vsix. Between 12:58 and
IncidentOn March 22, 2025, Aqua Security detected unauthorized Docker image tags for Trivy—their widely-used container vulnerability scanner—appearing without corresponding GitHub releases. The investigation
GeneralUnderstanding the Shift The cloud-native ecosystem has reached a pivotal point. Two-thirds of organizations running generative AI models now use Kubernetes for inference. This isn t just a trend—it s
IncidentWhat Happened Security researchers at Novee Security discovered a critical remote code execution vulnerability in Google s Gemini CLI tool, rated with a CVSS score of 10.0. This flaw affected versions
IncidentWhat Happened Google patched a critical vulnerability in the Gemini CLI package and its GitHub Actions workflow, which received a CVSS score of 10.0—the highest severity rating. This flaw allowed atta
DeadlinesYour team just adopted AI-powered security scanning. The vendor promised 90% fewer false positives, automated remediation, and security that integrates directly into the IDE. Three months later, you r
IncidentWhat Happened The elementary-data package on PyPI, downloaded over 1.1 million times monthly, was compromised to distribute version 0.23.3 containing malware designed to steal sensitive data and crypt
IncidentWhat Happened A high-severity vulnerability in Docker Engine (CVE-2026-34040, CVSS 8.8) allowed attackers to bypass authorization plugins and gain host access through a malformed HTTP request. This fl
