Expert perspectives on application security, compliance, and emerging threats
IncidentVulnerability Overview AI browsers from leading vendors are vulnerable to prompt injection attacks, despite multiple security measures. These attacks let malicious actors manipulate AI browsing featur
IncidentOn February 11, 2025, CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog. Within 48 hours, security researchers recorded 650 exploitation attempts from 244 unique IP addresses tar
IncidentWhat Happened Between October and December 2024, attackers used stolen npm credentials to publish malicious versions of over 400 packages. These releases contained a variant of the Mini Shai-Hulud cre
IncidentSecurity researchers at Oligo Security have uncovered a threat actor, TeamPCP, that has been active since 2020. Initially targeting infrastructure like Redis, Docker, and Kubernetes, they ve now shift
Get weekly security insights and compliance updates delivered to your inbox.
IncidentA malicious agent configuration file shouldn t give an attacker root access to your control plane. But in Paperclip s case, it did exactly that. What Happened Oasis Security disclosed two critical vul
IncidentAn attacker can take over your WordPress site without knowing a single password. That s the reality of CVE-2026-64638, a pre-authentication cross-site scripting vulnerability affecting all WordPress v
IncidentOn March 24, 2026, two malicious versions of LiteLLM, 1.82.7 and 1.82.8, appeared on PyPI. This package, which routes API calls across multiple LLM providers, was compromised by TeamPCP, a group targe
IncidentWhat Happened On July 17, 2026, IBM disclosed CVE-2026-9198 , a critical remote code execution vulnerability in Langflow, its open-source AI workflow automation platform. This flaw allows attackers to
IncidentWhat Happened PortSwigger s HTTP Terminator, an AI-assisted vulnerability research system, identified a zero-day vulnerability in Apache Traffic Server while testing HTTP desynchronization techniques.
IncidentOn August 5, Novee Security demonstrated at Black Hat USA how two widely used AI coding assistants could leak CI/CD secrets through a simple attack: a crafted GitHub issue. Both Anthropic s Claude Cod
GeneralYour team is probably using AI coding assistants like GitHub Copilot or Amazon CodeWhisperer. These tools promise to speed up development and automatically fix bugs. The pitch is compelling: let AI ha
IncidentOn August 4, 2026, the Shai-Hulud malware campaign struck npm, infecting packages in the keyv and cacheable ecosystems. By the time Sonatype s research team flagged it, 2,225 component versions were c
IncidentA critical vulnerability in JetBrains TeamCity (CVE-2026-63077) is being actively exploited. CISA added it to the Known Exploited Vulnerabilities catalog and issued Binding Operational Directive (BOD)
IncidentWhat Happened A public-facing web application with a SQL injection vulnerability became the entry point for an attack that ended with SYSTEM-level code execution on a Windows server. The attackers did
IncidentWhat Happened Attackers exploited a SQL injection vulnerability to access an Oracle Database and used its Java capabilities to install a custom toolkit called Khunt. They used Oracle s CREATE JAVA SOU
IncidentOn July 27, 2026, Huntress discovered an attack that should change how you think about database security. Hackers didn t just steal data from an Oracle database, they turned the database itself into a
