Expert perspectives on application security, compliance, and emerging threats
GeneralSecurity teams often focus on data exfiltration when considering AI risks. Your DLP alerts fire when someone pastes code into ChatGPT. Your CASB flags uploads to Claude. You ve probably written a poli
StandardsScope - What This Guide Covers This guide focuses on implementing machine identity security programs. You ll find specific controls for service accounts, API keys, certificates, tokens, and AI agents
IncidentWhat Happened Varonis Threat Labs revealed a prompt injection attack against Microsoft M365 Copilot Enterprise that exposed internal corporate data through manipulated URL parameters. The attack, call
IncidentA vulnerability fix in a widely-used Golang JWT package was never merged into the version most developers used. This oversight left projects exposed to authentication bypass, despite the existence of
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Novo Nordisk experienced a security breach when an attacker accessed its systems through a leaked GitHub token. This token, a credential for automated systems to interact with the compan
IncidentWhat Happened Your developers store credentials on their laptops. Git history, environment files, configuration snippets, and API keys are all vulnerable on machines that connect to public WiFi, run u
ResearchYou ve sat through the vendor demo. The slide deck claims 99% accuracy in bold letters. The sales engineer points to benchmark results showing their tool catches more vulnerabilities than competitors.
IncidentWhat Happened F5 released emergency security patches for critical vulnerabilities in NGINX web server modules. Two vulnerabilities—CVE-2026-42530 and CVE-2026-42055—allow unauthenticated remote attack
IncidentOn June 17, 2026, Sonatype researchers identified a supply chain attack targeting the Mastra AI framework. The attacker published a malicious npm package named easy-day-js , designed to mimic the popu
IncidentWhat Happened A mid-sized SaaS company discovered a critical remote code execution (RCE) vulnerability in their customer-facing API on day 14 of its exposure. The vulnerability came from an outdated d
IncidentThe Breach: A Summary In early 2020, attackers infiltrated SolarWinds build environment, embedding malicious code into the Orion platform update process. When SolarWinds released the compromised updat
IncidentWhat Happened A Java application using snakeyaml before version 1.26 processed a malicious YAML file, triggering a Denial of Service vulnerability. The attack exploited YAML s entity expansion feature
IncidentA vulnerability in the Google Cloud Vertex AI SDK allowed attackers to replace legitimate machine learning models with malicious ones—without needing credentials. Discovered by Palo Alto Networks Unit
IncidentWhat Happened Google s Vertex AI SDK for Python versions 1.139.0 and 1.140.0 had a design flaw allowing attackers to execute arbitrary code. The issue arose from predictable cloud storage bucket namin
IncidentWhat Happened In 2019, a former AWS employee exploited a server-side request forgery (SSRF) vulnerability in Capital One s web application firewall configuration to access the EC2 instance metadata se
IncidentOn June 17, 2026, an attacker accessed a dormant npm account belonging to a former Mastra contributor. Within hours, they republished every package in the @mastra scope with a malicious dependency tha
