Expert perspectives on application security, compliance, and emerging threats
ResearchWhen Microsoft disclosed the AutoJack vulnerability in AutoGen Studio, the attack vector was clear: three layered weaknesses in the Model Context Protocol (MCP) WebSocket implementation allowed malici
ResearchYou ve sat through the vendor demo. The slide deck claims 99% accuracy in bold letters. The sales engineer points to benchmark results showing their tool catches more vulnerabilities than competitors.
ResearchYour team s JetBrains environment is now an attack vector. Since October 2025, malicious plugins posing as AI coding assistants have been stealing API keys from developer workstations. Two such plugin
ResearchOnly 11% of AI agents deployed in production meet high security standards. This statistic should alarm you, but what s more concerning is why the other 89% fail — and how similar the mistakes are acro
Get weekly security insights and compliance updates delivered to your inbox.
ResearchYour security team approved an OAuth app six months ago. The publisher s domain is now parked. The app still has read access to your company s Google Drive. This isn t a hypothetical. An OhAuth audit
ResearchReliaQuest has identified a threat cluster named OP-512 deploying custom web shell frameworks against Microsoft IIS servers, with moderate to high confidence attribution to China-based actors. The fra
ResearchYour package.json scripts are clean. Your lockfile passes integrity checks. You run npm audit before every deployment. Yet, you re still vulnerable to the attack vector that compromised 281 npm packag
ResearchSocket s research into the TrapDoor campaign reveals a critical issue your security team may have overlooked: developer workstations are now high-value targets. These workstations often run unmonitore
ResearchYou found a Google API key in a public GitHub repo. You deleted it immediately. Your work is done, right? Not for the next 23 minutes. Aikido Security s research confirms that deleted Google API keys
ResearchA security researcher deleted a Google API key and watched it authenticate successfully for the next 23 minutes. The provider s documentation claimed immediate deactivation. This gap between promise a
ResearchYour team ships code 55% faster with AI assistance. But when that code breaks in production at 2 AM, can they fix it? This isn t a hypothetical problem. According to Octopus Deploy research, 73% of or
ResearchImagine your team just renewed all your domains. Six months later, one expires because the credit card on file failed. A week after that, someone else registers it. They now control a domain that your
ResearchAbout six months ago, questions began surfacing in our Slack channels as teams started deploying RAG pipelines to production. A security engineer discovered that their vector database contained custom
ResearchWhen Anthropic released Claude in Chrome, your security team may have assumed the extension would follow the same isolation model as other browser extensions. This assumption was incorrect. LayerX Sec
ResearchBetween July 16 and 22, 2025, three malicious packages—uuid32-utils, colorinal, and termncolor—were on PyPI delivering ZiChatBot malware. They ve been removed, but new threats are constantly emerging.
ResearchWhen a repository triggers code execution before you ve reviewed a single line, your development environment becomes an attack surface. The TrustFall vulnerability in Claude Code highlights this risk:
