Expert perspectives on application security, compliance, and emerging threats
IncidentA vulnerability in Ruby on Rails libvips image processing library (CVE-2026-66066) has been actively exploited since early March 2024. VulnCheck recorded more than 360 exploitation attempts within the
IncidentWhat Happened A development team using LLM-assisted code generation released multiple pull requests containing hardcoded API keys, database credentials, and overly permissive access controls. The code
ResearchA Harvard Business School study tracking GitHub activity reveals something your security team needs to see: developers using Copilot increased their coding time by 12.4%, while their project managemen
IncidentWhat Happened Researchers found that AI coding agents can follow hidden instructions in project README files, even if those instructions lead to data leaks. In tests using ReadSecBench, a specialized
Get weekly security insights and compliance updates delivered to your inbox.
GeneralThe Conventional Wisdom Security teams are rushing to implement tamper-evident logging for AI agents. The logic seems sound: hash-chained logs prevent modification, cryptographic signatures prove auth
StandardsThe OWASP Top 10 for LLM Applications got a major update in late 2024. Unlike the classic OWASP Top 10 for web apps, this framework addresses risks unique to large language models: prompt injection, d
ResearchResearch presented at RSAC 2026 highlights a significant issue: Model Context Protocol (MCP) introduces architectural vulnerabilities in LLM environments that can t be resolved with patches. Unlike a
GeneralThe Conventional Wisdom Your compliance team wants to know if the AI model you re deploying is secure. Your vendor shows you certifications. Your engineers run penetration tests against the model s AP
Vendor NewsYour open source project just received 47 security reports this week. Twelve came from the same AI tool. Six are duplicates. Three describe features, not bugs. Somewhere in that pile might be a critic
IncidentIncident Overview An AI-powered customer service system fell victim to a malicious prompt that extracted internal knowledge base content and exposed it to an unauthorized user. The attack succeeded be
GeneralIf you re building agentic AI systems, you ve probably considered an MCP Gateway as your security layer. Don t. While the abstraction looks clean on architecture diagrams, it creates more problems tha
GeneralYou re reviewing more pull requests than ever. Your team s throughput has doubled, and you re catching issues you ve never seen before: logic errors that compile cleanly, API calls that look right but
IncidentWhat Happened Internet-wide scanning has revealed 175,000 Ollama servers with publicly accessible APIs. Ollama, a tool for running large language models locally or on cloud infrastructure, exposes a R
IncidentA supply chain attack compromised 19 Chrome and Edge extensions between December 2024 and January 2025. Attackers acquired legitimate extensions, pushed malicious updates through official channels, an
GeneralScope This guide addresses the perception gap between executive leadership and security practitioners on AI system security. It s designed for security engineers who need to: Translate technical AI se
ResearchYou ve got three AI-powered application security scanners running against your codebase. Scanner A flags 127 issues. Scanner B finds 89. Scanner C reports 156. They agree on exactly 5% of their findin
