Expert perspectives on application security, compliance, and emerging threats
IncidentThe Problem Organizations are deploying LLM servers with default configurations, missing authentication, and public network exposure. Attackers are actively scanning for exposed AI infrastructure and
IncidentIntroduction Google has launched CodeMender, an AI-powered security tool that autonomously identifies, confirms, and patches code vulnerabilities without waiting for manual intervention. This tool, su
IncidentYour AI coding assistant just suggested a Python package to solve your authentication problem. The name sounds plausible. You install it. Your build passes. Three weeks later, you discover it s malwar
IncidentYour AI coding assistant just installed a package that doesn t exist. Or rather, it didn t exist until an attacker predicted it would hallucinate that exact name and registered it first. This isn t th
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn a Tuesday afternoon, Aikido Security deployed their AI pentest agents on NodeBB, a federated forum platform. Six hours later, they identified eight high-severity vulnerabilities, including direct a
GeneralYour security team can see the AI agents running across your SaaS platforms, developer environments, and cloud workflows. You ve cataloged them, mapped their API calls, and maybe even built a dashboar
GeneralThe Conventional Wisdom Security teams are revisiting their incident response playbooks from the worm era, convinced that lessons from Code Red, Nimda, and Slammer will help secure AI systems. The ide
IncidentOn July 13, 2026, ServiceNow released patches for CVE-2026-6875, a critical vulnerability in its AI Platform that allows unauthenticated remote code execution. Five days later, researchers observed ac
IncidentWhat Happened On July 8, 2026, the Python Package Index (PyPI) implemented a significant change. You can no longer upload new files to a release that s more than 14 days old. If you need to add a Pyth
IncidentWhat Happened Anthropic s Mythos Preview announcement marked a turning point in how your security team should approach threat mitigation. It wasn t about a breach or vulnerability disclosure. Instead,
IncidentBetween July 12 and 13, 2026, attackers compromised ten Packagist packages tied to a legitimate PHP developer s account. They injected 583 malicious GitHub Actions workflow files across those packages
IncidentIn 2025, security teams faced 48,185 newly published CVEs, a 20.6% increase over 2024. That s 130 vulnerabilities disclosed every day. If your team tried to patch everything, you d never ship code aga
IncidentAn attacker sent a phishing link. The victim clicked it while logged into ChatGPT. Four clicks later, an autonomous AI agent was installed in their OpenAI workspace with persistent access to Outlook,
IncidentA critical vulnerability in Windmill s workflow platform lets attackers read any file on your server without logging in. If you re running an unpatched instance, they ve likely already done it. What H
IncidentOn the day Mozilla released 18 security patches for Firefox, Anthropic s red team used Claude Mythos Preview to analyze them. Within an hour, the AI had reverse-engineered the first patch into working
IncidentThe Problem: Overwhelming Vulnerability Alerts A Fortune 100 financial enterprise was overwhelmed by vulnerability alerts. Their scanning tools flagged about 40 million potential vulnerabilities acros
