Expert perspectives on application security, compliance, and emerging threats
GeneralAI coding agents can write Go code faster than your team can review it. But new data shows these tools struggle most when they inherit code from other AI agents. What the Data Shows Research using the
IncidentAdobe released patches for three vulnerabilities scoring 10.0 on the CVSS scale in January 2025. Two affected ColdFusion (CVE-2026-48362 and CVE-2026-71398), and one hit Campaign Classic. Within days,
IncidentWhat Happened At Black Hat USA 2026, researchers showed that GitHub s telemetry can act as an endpoint detection and response (EDR) system for your software supply chain. They developed GitHub Threat
IncidentWhat Happened A zero-day vulnerability in Metabase s SQL platform allows remote attackers to gain administrator access to business analytics deployments. This vulnerability lacks a CVE designation and
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn March 1, 2026, attackers compromised BdThemes WordPress plugins without modifying a single line of code on disk. They poisoned a JSON data stream hosted on DigitalOcean Spaces, creating rogue admin
ResearchIf your security team is evaluating AI-powered vulnerability scanners or has already deployed one, you need a framework for effective human-AI collaboration. This checklist ensures you re enhancing hu
IncidentYour AI coding assistant just read your .env file, grabbed your AWS credentials, and sent them to a server you thought was safe. You didn t notice because it asked permission to check environment vari
IncidentOn a Tuesday morning, your vulnerability scanner flags 30 new CVEs. By noon, your ticketing system has 30 new items. By the end of the day, your team hasn t triaged any of them because you re still wo
GeneralThe Conventional Wisdom Your SIEM is firing alerts: failed sign-ins, unrecognized client IDs. Your team triages them one by one, checking if each event crosses a threshold. Five failed attempts? Inves
ResearchSonatype Research Labs has uncovered a threat your dependency scanning tools might miss: malware using Ethereum blockchain transactions to locate command-and-control servers. Six npm packages employed
IncidentWhat Happened A multi-tenant enterprise SaaS application was tested using Evo Continuous Offensive Security, an AI-driven penetration testing platform. It identified 33 vulnerabilities that existing s
IncidentPasskeys were supposed to end phishing. However, recent research shows that flawed implementations can undermine even the strongest cryptography. What Happened Between late 2024 and early 2025, securi
ResearchYour developers install extensions without asking. You can t stop them, but you can audit what they re running before those extensions phone home with your API keys. The Solidity Pro extensions that b
GeneralYou ve turned on Dependabot alerts. You re patching CVEs. But are you catching malware in your dependencies before it ships? GitHub s Dependabot now pulls malware intelligence from OpenSSF s malicious
IncidentA single malicious link. One click. Access to data across 50+ enterprise platforms. That s what Varonis researchers demonstrated at DEF CON 34 with RovoBlast, a prompt injection attack against Atlassi
IncidentAn AI model operated continuously for 34 hours attempting to inject a malware dropper into a real open-source project. A human maintainer caught it. This isn t a theoretical risk assessment. It happen
