Expert perspectives on application security, compliance, and emerging threats
IncidentA development team at a mid-sized software company used an AI coding assistant to patch a known vulnerability in their authentication library. The AI generated clean, functional code that passed all u
IncidentOn December 13, 2020, FireEye disclosed that nation-state actors had compromised their red team tools. Within days, the scope widened: attackers had trojanized SolarWinds Orion software updates, turni
IncidentWhat Happened On December 17, 2024, PyPI implemented a rule blocking new file uploads to package releases older than 14 days. GitHub followed with a default three-day cooldown period in Dependabot bef
IncidentAn attacker compromised Claude Code s memory system. No credentials were stolen. No malware was deployed. Instead, the attack poisoned the AI s stored context, the preferences, workflows, and learned
Get weekly security insights and compliance updates delivered to your inbox.
IncidentMalicious versions of legitimate npm packages recently went live on the registry, but they were caught and removed within two hours. This incident led GitHub to introduce a three-day delay for Dependa
IncidentYour Spring Boot application uses Fastjson 1.x for JSON parsing. Threat actors are exploiting CVE-2026-16723 in the wild. The CVSS score is 9.0. As of July 25, Alibaba hasn t released a patched versio
IncidentIn early 2024, researchers monitoring cybercrime forums documented a seven-month conversation among threat actors exploring AI tools. The analysis covered more than 160 forum threads where criminals d
IncidentThe Problem Organizations are deploying LLM servers with default configurations, missing authentication, and public network exposure. Attackers are actively scanning for exposed AI infrastructure and
IncidentIntroduction Google has launched CodeMender, an AI-powered security tool that autonomously identifies, confirms, and patches code vulnerabilities without waiting for manual intervention. This tool, su
IncidentYour AI coding assistant just suggested a Python package to solve your authentication problem. The name sounds plausible. You install it. Your build passes. Three weeks later, you discover it s malwar
IncidentYour AI coding assistant just installed a package that doesn t exist. Or rather, it didn t exist until an attacker predicted it would hallucinate that exact name and registered it first. This isn t th
IncidentOn a Tuesday afternoon, Aikido Security deployed their AI pentest agents on NodeBB, a federated forum platform. Six hours later, they identified eight high-severity vulnerabilities, including direct a
IncidentOn July 13, 2026, ServiceNow released patches for CVE-2026-6875, a critical vulnerability in its AI Platform that allows unauthenticated remote code execution. Five days later, researchers observed ac
IncidentWhat Happened On July 8, 2026, the Python Package Index (PyPI) implemented a significant change. You can no longer upload new files to a release that s more than 14 days old. If you need to add a Pyth
IncidentWhat Happened Anthropic s Mythos Preview announcement marked a turning point in how your security team should approach threat mitigation. It wasn t about a breach or vulnerability disclosure. Instead,
IncidentBetween July 12 and 13, 2026, attackers compromised ten Packagist packages tied to a legitimate PHP developer s account. They injected 583 malicious GitHub Actions workflow files across those packages
