Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1020 Security Engineers1020 Compliance Teams274 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All1020 Incident911 General269 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

1020 articles in Security Engineers · Clear filtersSort byNewest·Trending

Langflow CVE-2026-0768: Unauthenticated RCE Leads to API Key Theft

Langflow CVE-2026-0768: Unauthenticated RCE Leads to API Key Theft

Your AI development framework just handed attackers root access and every API key in your environment variables. No authentication required. What Happened Attackers exploited CVE-2026-0768 in Langflow

For Security EngineersRead article

McKinsey's 200 Exposed APIs: A Teardown

McKinsey's 200 Exposed APIs: A Teardown

What Happened McKinsey s internal AI platform exposed over 200 documented endpoints to the internet without authentication. External researchers found these APIs, which provided direct access to inter

For Security EngineersRead

JFrog Artifactory CVE-2026-82329: How Admin Access Was Bypassed in Hours

JFrog Artifactory CVE-2026-82329: How Admin Access Was Bypassed in Hours

What Happened On August 28, JFrog disclosed CVE-2026-82329, a critical authentication bypass vulnerability in Artifactory with a CVSS score of 9.8. This flaw allows attackers to gain administrative pr

For Security EngineersRead

Secrets Scanners Won't Save You

Secrets Scanners Won't Save You

Your team runs Gitleaks. You ve got pre-commit hooks. You scan every PR. So you re protected from credential leaks, right? Not exactly. The arrival of Betterleaks, a next-generation fork of Gitleaks d

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

AI Pentesting Won't Replace Your Manual Tests

AI Pentesting Won't Replace Your Manual Tests

The conventional wisdom : Organizations should adopt AI pentesting tools to replace manual security testing because automation is faster, more comprehensive, and catches vulnerabilities that humans mi

For Security EngineersRead

AI Agents Ran Malicious Code from Git Configs

AI Agents Ran Malicious Code from Git Configs

When you clone a repository, you expect your AI coding assistant to help write code. You don t expect it to execute an attacker s commands without asking. That s exactly what happened with eight vulne

For Security EngineersRead

Agent Context Poisoning Is Now a CVE Category

Agent Context Poisoning Is Now a CVE Category

The OpenSSF Tech Talk on March 17, 2026, at 1:00 PM ET marks a significant shift in classifying AI security vulnerabilities. Angela McNeal will discuss agent autonomy and context integrity as new secu

For Security EngineersRead

AI Agents Built Two Apps, Introduced 143 Vulnerabilities

AI Agents Built Two Apps, Introduced 143 Vulnerabilities

What Happened DryRun Security tested three AI coding agents, OpenAI Codex GPT 5.2, GitHub Copilot Workspace, and Replit Agent, on two application builds. The agents generated code for a task managemen

For Security EngineersRead

Attackers Mint Admin Tokens Four Days After JFrog Patch

Attackers Mint Admin Tokens Four Days After JFrog Patch

What Happened On August 28, 2026, JFrog released Artifactory version 7.161.20 to patch CVE-2026-82329 , an authentication bypass vulnerability with a CVSS score of 9.8. Just four days later, on Septem

For Security EngineersRead

Your Team Asked: How Do We Actually Govern Shadow AI?

Your Team Asked: How Do We Actually Govern Shadow AI?

Last week, three different Slack threads raised similar concerns. A developer questioned if ChatGPT was a sanctioned tool. An engineer wondered if copying code into Claude breached data handling polic

For Security EngineersRead

Traditional Threat Modeling Won't Secure Your LLMs

Traditional Threat Modeling Won't Secure Your LLMs

The conventional wisdom : Your existing threat modeling framework will work fine for AI systems. Just add LLM-specific threats to your STRIDE analysis, update your data flow diagrams, and you re cover

For Security EngineersRead

npm Malware Broke 500 Packages in Four Days

npm Malware Broke 500 Packages in Four Days

Your package manager trusts every update it receives. That trust just became your biggest vulnerability. Between September 14th and 18th, the Shai-Hulud worm altered more than 500 package versions on

For Security EngineersRead

Cursor's Security Review Automation: What Went Right

Cursor's Security Review Automation: What Went Right

Cursor s security review system identifies over 200 vulnerabilities weekly across 3,000+ internal pull requests. This isn t a security incident; it s a testament to effective automation. It highlights

For Security EngineersRead

AI Agents Don't Need Exploits to Leak Data

AI Agents Don't Need Exploits to Leak Data

You ve probably invested in prompt injection defenses, model guardrails, and access controls for your AI deployments. Your security checklist looks solid. But here s what most teams miss: the gap betw

For Security EngineersRead

Agentic AI Cuts Threat Response from Days to Minutes

Agentic AI Cuts Threat Response from Days to Minutes

Introduction In 2026, Frost Sullivan recognized Picus Security as the Innovation Index Leader in their Frost Radar report on Automated Security Validation. This accolade wasn t for minor tweaks to exi

For Security EngineersRead

Active Traceability for Software Supply Chains

Active Traceability for Software Supply Chains

Scope This guide covers implementing active traceability systems in software supply chains, focusing on the security and governance challenges introduced by AI-assisted development. You ll find requir

For Security EngineersRead

Showing 17-32 of 1020 articles

PreviousPage 2 of 64Next