Expert perspectives on application security, compliance, and emerging threats
IncidentIn 2025, security teams faced 48,185 newly published CVEs, a 20.6% increase over 2024. That s 130 vulnerabilities disclosed every day. If your team tried to patch everything, you d never ship code aga
IncidentAn attacker sent a phishing link. The victim clicked it while logged into ChatGPT. Four clicks later, an autonomous AI agent was installed in their OpenAI workspace with persistent access to Outlook,
IncidentA critical vulnerability in Windmill s workflow platform lets attackers read any file on your server without logging in. If you re running an unpatched instance, they ve likely already done it. What H
IncidentOn the day Mozilla released 18 security patches for Firefox, Anthropic s red team used Claude Mythos Preview to analyze them. Within an hour, the AI had reverse-engineered the first patch into working
Get weekly security insights and compliance updates delivered to your inbox.
IncidentThe Problem: Overwhelming Vulnerability Alerts A Fortune 100 financial enterprise was overwhelmed by vulnerability alerts. Their scanning tools flagged about 40 million potential vulnerabilities acros
IncidentWhat s Happening? Cisco has introduced Antares, a family of AI models with 350 million, 1 billion, and 3 billion parameters. These models aim to help your security team identify vulnerable code by pro
IncidentA security assessment of AI-generated codebases revealed a consistent pattern: each repository contained an average of 15 vulnerabilities. This finding emerged from analyzing production code written b
IncidentBetween August 13 and October 10, 2025, a package named Newtonsoftt.Json.Net appeared on NuGet . It mimicked Newtonsoft.Json, a popular JSON library in .NET, but it was a trojan targeting the Digitain
IncidentWhat Happened Between December 2025 and early January 2026, attackers exploited two chained vulnerabilities in WordPress core to achieve unauthenticated remote code execution. The exploit chain, dubbe
IncidentWhat Happened On July 17, 2025, attackers exploited critical vulnerabilities in WordPress s REST API batch-processing feature to install webshells and malicious plugins on unpatched sites. SearchLight
IncidentWhat Happened Microsoft patched CVE-2026-50522 in their January 2025 security update, but attackers quickly exploited it. The vulnerability, discovered by DEVCORE researchers, allows an attacker with
IncidentWhat Happened AWS s Kiro IDE had a vulnerability that allowed attackers to rewrite its configuration file and execute code without triggering approval prompts. Intezer s research team found that Kiro
IncidentWhat Happened Pillar Security disclosed vulnerabilities in Cursor, Codex CLI, Gemini CLI, and Antigravity that allow AI agents to execute arbitrary code without triggering sandbox violations. Instead
IncidentWhat Happened Attackers began exploiting two WordPress vulnerabilities within three days of their public disclosure. The attack chains CVE-2026-60137 and CVE-2026-63030 together, creating a path to re
IncidentWhat Happened Three RubyGems packages, impersonating legitimate Ruby tools, were hijacked and republished with malicious code to steal credentials from developer workstations. These packages scanned f
IncidentA critical vulnerability in ServiceNow s AI Platform is being actively exploited. CVE-2026-6875 allows attackers to execute code remotely without authentication. ServiceNow issued patches for self-hos
