Expert perspectives on application security, compliance, and emerging threats
IncidentIn February 2024, JFrog researchers discovered a weaponized PyTorch model on Hugging Face that opened a reverse shell on any system that loaded it. The model sat in a public repository, unsigned and u
IncidentWhat Happened On December 18, 2024, a zero-day SQL injection vulnerability in GeoServer s jsonArrayContains function was publicly disclosed on social media. This flaw lets unauthenticated attackers in
StandardsYou re staring at a vulnerability backlog that s grown 40% in six months. Your scanning tools flag more issues every sprint. Security researchers are using AI to discover edge cases you ve never seen
IncidentThe Problem A security team recently completed a major remediation effort, closing 251 vulnerability tickets across their application portfolio. They achieved 98% patch compliance, and the dashboard s
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn January 14, 2025, Rapid7 Labs disclosed a critical exploit chain targeting Microsoft SharePoint Server. The chain combines CVE-2026-55040 (CVSS 9.1, JWT authentication bypass) and CVE-2026-63520 (r
IncidentOn October 13, 2026, the deadline for NIST s Request for Information (RFI) will close. If your team hasn t submitted feedback yet, you re missing a key opportunity to influence the future of vulnerabi
IncidentOn December 20, 2024, developers installing LiteLLM versions 1.82.7 or 1.82.8 from PyPI unknowingly turned their workstations into credential extraction engines. The TeamPCP threat actor had compromis
IncidentA vulnerability in libpng went undetected for three decades before it was patched in February 2026. Similarly, Windows PrintDemon lingered in production code for 24 years before Microsoft addressed it
IncidentWhat Happened CVE-2026-71362 allows attackers to hijack customer accounts on Adobe Commerce and Magento platforms without authentication. Adobe released patches for this vulnerability along with fixes
GeneralThe Conventional Wisdom Your security team is probably planning how to defend against AI-powered browser agents. New threat model, new controls, new budget asks. The assumption: autonomous browsers re
IncidentOn patch Tuesday in December 2024, SAP disclosed CVE-2026-58231, a vulnerability in SAP Commerce Cloud that scored 10.0 on CVSS. This is the highest severity rating possible. An unauthenticated attack
IncidentTracebit researchers discovered something unexpected while testing AI security tools on Amazon Web Services: they could stop automated hacking agents mid-attack by placing specific text strings next t
IncidentA vulnerability in a new package just gave attackers complete access to business intelligence data across thousands of organizations. On August 6, researchers disclosed CVE-2026-72898, a SQL Injection
IncidentOn March 24, malicious versions of LiteLLM were uploaded to PyPI for just 40 minutes. In that brief period, credential-stealing code infiltrated CI/CD pipelines at over 2,500 organizations, according
ResearchA research team decoded 315,320 thinking blocks from 6,708 public agent trajectories and recovered 704 distinct privacy artifacts, including 62 API keys and 33 passwords, from OpenAI, Anthropic, and G
IncidentAI s Breakthrough and the Human Oversight Gap James Kettle at PortSwigger Research developed an autonomous system called the HTTP Terminator to explore whether AI could independently create new attack
