Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened Bugcrowd recently revised its submission policies after a surge of low-quality, AI-generated vulnerability reports. Researchers submitted findings that looked polished but lacked proof t
IncidentThe Problem In 2024, CISA and four international cybersecurity agencies released joint guidance urging software vendors to establish formal coordinated vulnerability disclosure (CVD) programs. This wa
IncidentOn June 24, 2026, n8n patched CVE-2026-59208, a vulnerability in their token exchange mechanism that allowed attackers to authenticate as users from a different token issuer. If your Enterprise instan
IncidentSAP s July 2026 security update included CVE-2026-44747 , an out-of-bounds write vulnerability in NetWeaver Application Server ABAP with a CVSS score of 9.9. This flaw allows an authenticated attacker
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened OpenAI used GPT-Red, an automated adversarial testing system, to identify prompt injection vulnerabilities in GPT-5.6 Sol before its release. The testing showed that earlier versions wer
IncidentIn December 2024, researchers at Seoul National University demonstrated a new attack that made AI agents perform unintended actions. This attack succeeded up to 50% of the time against current defense
IncidentWhat Happened Anthropic s Claude for Chrome extension has two vulnerabilities that allow malicious browser extensions to hijack the AI s capabilities to read and exfiltrate user data. Security researc
IncidentIntruder s security research team discovered a SQL injection vulnerability in the Creative Mail plugin for WordPress using an automated pipeline that combines traditional code scanning with AI analysi
IncidentCISA issued Emergency Directive 25-01 on January 15, 2025, ordering federal agencies to patch or mitigate two remote code execution vulnerabilities in Joomla extensions within 72 hours. The flaws in i
IncidentWhat Happened SAP released 16 security patches in July 2026, including three critical vulnerabilities that could let attackers access unauthorized data, crash systems, or trigger denial-of-service con
IncidentWhat Happened Tracebit researchers conducted an experiment that should concern anyone developing AI-powered security tools. They deployed autonomous AI agents in test environments to see how quickly t
IncidentOn a typical Tuesday, a widely-used JavaScript protection tool became an attack vector. The Jscrambler npm package , trusted by development teams for code obfuscation and security, was compromised wit
IncidentWhat Happened In December 2024, security researchers disclosed a vulnerability in Cursor, an AI-powered code editor, that allows automatic execution of malicious code when a developer opens a compromi
IncidentWhat Happened Attackers used generative AI to create over 400 custom exploitation scripts, compromising more than 300 servers in a single breach. The speed and scale were beyond human capability. This
IncidentOverview Google Cloud recently introduced AI-powered security agents at Next 26, highlighting that its Triage and Investigation agent processed over 5 million alerts in the past year. Additionally, Go
IncidentWhat Happened In October 2024, Anthropic deployed an AI agent called Mythos to scan its codebase. The system identified roughly 1,000 potential vulnerabilities in just 10 hours. For context, that s ab
