Expert perspectives on application security, compliance, and emerging threats
IncidentOn January 14, 2025, WordPress disclosed two chained vulnerabilities that allowed unauthenticated attackers to achieve remote code execution on any WordPress Core installation. Within hours, WordPress
IncidentIn March 2026, the TeamPCP attack compromised Trivy, Checkmarx, LiteLLM, and dozens of npm packages. Security teams knew about the vulnerabilities. They d logged tickets, assigned severity scores, and
IncidentWhat Happened On July 15, F5 patched CVE-2026-42533, a heap buffer overflow in nginx that allows remote attackers to crash worker processes and potentially execute arbitrary code. The vulnerability af
IncidentWhat Happened Attackers have found a way to spoof OAuth client IDs to bypass Microsoft Entra ID sign-in logs. By using a fake OAuth client ID during authentication, the sign-in event either doesn t ap
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened In the past 18 months, security teams have noticed a shift in how attackers probe their systems. SQL injection vulnerabilities that sat dormant in quarterly scan reports for years are no
GeneralYour developers are shipping AI agents that need database passwords, API keys, and service account credentials. Meanwhile, your security team is discovering these secrets hardcoded in configuration fi
IncidentWhat Happened In early 2026, Searchlight Cyber discovered two critical remote code execution vulnerabilities in WordPress Core, tracked as CVE-2026-63030 and CVE-2026-60137. These vulnerabilities, kno
IncidentOn January 29, 2025, the WordPress security team disclosed two high-severity vulnerabilities affecting WordPress 6.9 and the 7.1 beta release. Both issues, tracked as CVE-2026-60137 and CVE-2026-63030
IncidentOn July 18, 2026, WordPress released emergency patches for versions 6.9 and 7.0 to fix a critical remote code execution vulnerability. The flaw, known as wp2shell, combines CVE-2026-63030 and CVE-2026
IncidentWhat Happened Between March and June 2026, OWASP CVE Lite CLI went from initial release to Lab Project status in just three months. The tool accumulated 621 GitHub stars, over 100 forks, and more than
IncidentBetween June 29 and July 3, 2026, a threat actor published seven malicious npm packages targeting developers using Vite, a popular frontend build tool. Checkmarx discovered the campaign, dubbed ViteVe
IncidentA Go-based botnet named NadMesh has been actively scanning for exposed AI services and harvesting cloud credentials. Research from QiAnXin s XLab reveals that the botnet s operator claims to have coll
GeneralYour web agents can read natural language. So can attackers. Cross-Site Prompting (XSP) exploits the same trust boundary weakness as Cross-Site Scripting, but instead of injecting JavaScript, attacker
DeadlinesYour Kubernetes controllers worked fine at 50 nodes. Now you re planning for 5,000, and you need to ensure they won t crash, leak resources, or create security gaps. This checklist walks through the o
IncidentWhat Happened OpenAI s automated red-teaming system, GPT-Red, successfully attacked a production AI agent and convinced it to reprice inventory. Items normally priced above $100 were marked down to $0
GeneralYou ve locked down your API keys, you re running static analysis on your codebase, and your network security team has implemented zero trust for human users. When your engineering team proposes deploy
