Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened On April 18, 2019, security researchers disclosed a CRLF injection vulnerability in urllib3 , a Python HTTP client library foundational to over 500 open-source libraries. This vulnerabil
IncidentWhat Happened On July 2, 2019, Snyk published CVE-2019-10744 , a prototype pollution vulnerability affecting every version of lodash. This library, used by 4.35 million projects on GitHub and download
IncidentOverview of the Issue A security analysis of the .NET ecosystem has highlighted a significant concentration of critical vulnerabilities that require immediate attention from your security team. Remote
IncidentThe Issue at Hand The jQuery team released version 3.4.0 to address a prototype pollution vulnerability in the library s object extension functionality. Researcher Olivier Arteau identified the flaw,
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn April 25, 2019, Docker Hub discovered unauthorized access to a database containing user data. Approximately 190,000 accounts were affected, exposing usernames, hashed passwords, and GitHub and Bitb
IncidentWhat Happened A malicious npm package named electron-native-notify targeted users of Komodo s Agama cryptocurrency wallet. A GitHub user, sawlysawly, disclosed the threat via a public commit, triggeri
IncidentWhat Happened An attacker compromised the maintainer account for the Ruby gem strong_password and published version 0.0.7 containing remote code execution capabilities. Rubygems.org reported 537 downl
IncidentWhat Happened A Denial of Service vulnerability (CVSS 5.3) in the Axios JavaScript HTTP client allowed attackers to force applications to process content beyond configured limits. This flaw affected a
GeneralYou re deploying AI agents at scale. Your compliance framework covers user access, service accounts, and third-party integrations. But what about the agents themselves? Enterprises expect to deploy an
IncidentA remote code execution vulnerability lay hidden in Webmin for over a year, affecting versions 1.890 through 1.920. This wasn t a coding mistake — it was a deliberate insertion by a malicious actor wh
IncidentWhat Happened Mozilla s Zero Day Investigative Network (0DIN) demonstrated an attack exploiting AI coding agents through legitimate-looking GitHub repositories. The repository contained no malicious c
IncidentWhat Happened Spring Boot version 2.1.7 shipped with jackson-databind 2.9.9, a JSON parsing library containing two high-severity deserialization vulnerabilities (CVE-2019-14379 and CVE-2019-14439). Th
GeneralThe Conventional Wisdom The industry consensus suggests running AI-generated code in isolated sandboxes before it touches production. Tools like Greptile s TREX feature and Cursor s cloud agents creat
GeneralOver the past year, fewer companies are relying on AI systems for penetration testing. This isn t a failure of innovation—it s a market correction after inflated expectations met operational reality.
GeneralYour AI coding assistant just wrote 6,000 lines of code. It compiled. Tests passed. Your CI pipeline is green. But when a verification agent checked those same 6,000 lines against your team s actual r
IncidentWhat Happened Attackers are exploiting CVE-2026-12569 , a remote code execution vulnerability in PTC Windchill, to deploy web shells on vulnerable systems. The flaw has a CVSS score of 9.3. CISA added
