Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened Noma Security discovered GitLost, a prompt injection attack exploiting GitHub s preview Agentic Workflows to leak private repository data. The attack is simple: an attacker submits a cra
GeneralScope This guide covers how to detect, prevent, and respond to malicious packages targeting payment integration SDKs on npm and PyPI . You ll find steps for validating package authenticity, monitoring
IncidentWhat Happened On June 30, 2026, Adobe released emergency patches for CVE-2026-48282, a path traversal vulnerability in ColdFusion s Remote Development Services (RDS) component. This vulnerability has
ResearchWhen Wiz published the GhostApproval pattern on July 8, they exposed a significant security issue: six major AI coding assistants were allowing malicious repositories to trick developers into granting
Get weekly security insights and compliance updates delivered to your inbox.
IncidentYour GitHub Actions workflows are green across the board. CodeQL found nothing. Your SAST tool gave you a clean bill of health. You re compliant, right? Not according to Novee Security, which just fla
IncidentA public GitHub issue with a cleverly-worded sentence can trick an AI agent into revealing the contents of your private repository. This isn t just theoretical. Researchers at Noma Security demonstrat
IncidentWhat Happened Your team integrated an AI coding assistant into the CI/CD pipeline to speed up feature delivery. Over three months, the assistant generated about 40% of the production code, including a
IncidentA single permission in Google Dialogflow CX could have let an attacker with edit rights on one chatbot agent compromise every other agent in the same Google Cloud project. Varonis discovered the flaw,
IncidentOn a Tuesday morning, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog. By Wednesday afternoon, security teams were dealing with active exploitation attempts. This was th
GuidesYou re running quarterly pen tests, patching critical CVEs within 30 days, and checking the compliance boxes. Then you discover a vulnerability that s already being exploited in production. The pen te
GeneralScope - What This Guide Covers You re reviewing code that emerged in minutes instead of weeks. Your traditional code review checklist doesn t account for AI-generated patterns, hallucinated dependenci
GuidesIf you re building or deploying AI agents that access production systems, you need an identity governance policy that works at agent speed. Traditional access control policies assume you re managing h
IncidentOn the same day Adobe disclosed CVE-2026-48282 , a critical vulnerability in ColdFusion, attackers were already probing for vulnerable servers. KEVIntel s honeypots captured exploitation attempts with
IncidentIn December 2021, your team scrambled to patch Log4Shell. You identified every instance of the vulnerable Log4j library, applied updates, and documented the remediation. Three months later, a routine
ResearchYour security team is evaluating AI systems that don t just analyze threats but conduct their own research, generate tools, and make operational decisions. Before you deploy autonomous AI in productio
GeneralThe Conventional Wisdom Your team reviews every pull request before it merges. Someone checks the logic, scans for obvious errors, and looks for security holes. You ve built this into your software de
