Expert perspectives on application security, compliance, and emerging threats
IncidentOn August 12, 2026, researcher @q1uf3ng disclosed a critical SQL injection vulnerability in GeoServer that enables remote code execution. Within hours, watchTowr detected active exploitation attempts.
IncidentOn July 31, 2026, WPMU DEV released version 1.56.2 of Forminator Forms to patch CVE-2026-15748, a vulnerability rated 9.8 on CVSS v3. This flaw allowed unauthenticated attackers to upload and execute
GeneralYour AI coding assistant just accessed your AWS credentials. Not because it was compromised, but because you gave it permission to help with deployment. The issue isn t malicious intent; it s unrestri
IncidentWhat Happened Your security team might run regular penetration tests on your infrastructure and network, but what about your web applications? In this case, a team conducted quarterly tests on their i
Get weekly security insights and compliance updates delivered to your inbox.
GuidesThe Problem Your open-source dependencies are maintained by volunteers who now spend 12 times longer reviewing AI-generated pull requests than it takes to generate them. That s not a productivity gain
IncidentBetween January and December 2025, the CVE Program disclosed 48,174 new vulnerabilities. That s 131 per day. Your team can t patch 131 things daily. Nobody can. The real problem isn t the volume. It s
GeneralScope This guide addresses the security implications of AI-assisted development tools like GitHub Copilot, Amazon CodeWhisperer, and Cursor on your application security program. It covers changes in t
IncidentA vulnerability researcher discovered that Salesforce and ServiceNow portals remained exposed for 17 months before detection. During that time, attackers exploited a Metabase zero-day to access custom
IncidentWhat Happened During DARPA s Artificial Intelligence Cyber Challenge (AIxCC), Team Atlanta deployed OSS-CRS, an AI-driven system designed to automatically detect and patch vulnerabilities in open sour
GuidesThe question at hand Your organization relies on thousands of API keys, service accounts, OAuth tokens, and machine credentials. Every CI/CD pipeline, microservice, and monitoring agent needs credenti
IncidentWhat Happened A mid-market organization tracked 847 vulnerabilities across their environment. Over three months, they reduced this number to 623. The security team celebrated the progress. However, an
GeneralYour container scanner found zero critical vulnerabilities. Your registry passed the security gate. Then a zero-day in a transitive dependency took down production. Surface-level container scanning ch
GeneralYour developers are using tools like GitHub Copilot, ChatGPT, and Claude to write code. Some teams report 30-50% productivity gains. Your CISO wants to know: what s the security impact? The answer dep
IncidentThe Breach Overview A financial services organization faced a major security breach when a single stolen credential led to domain-wide access. The initial entry point seemed minor: one set of credenti
IncidentYou deployed a fix for Log4Shell in December 2021. Your scanners showed clean. Three months later, an attacker used the same vulnerability to compromise a legacy microservice you forgot was still runn
IncidentOn a Tuesday, SAP released patches for CVE-2026-58231, a remote code execution vulnerability in Commerce Cloud with a CVSS score of 10.0. By Friday, threat intelligence firm Defused confirmed active e
