Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened In early 2025, security researchers at Knostic discovered 1,862 Model Context Protocol (MCP) servers exposed to the public internet without any authentication controls. These servers all
DeadlinesYour AI coding assistant just committed a database connection string to a public repository. The credentials were valid for 47 minutes before your monitoring caught it. During that time, an attacker a
IncidentGoogle s Threat Intelligence Group has disclosed a new threat your security program wasn t designed to handle: a working exploit developed entirely by AI. This vulnerability—a 2FA bypass implemented i
GeneralThe belief that AI-powered security tools will transform your software development lifecycle is widespread. Vendors promise AI-driven vulnerability detection, automated threat modeling, and intelligen
Get weekly security insights and compliance updates delivered to your inbox.
GeneralScope This guide addresses the security and governance challenges when your engineering team uses AI-assisted coding tools. You ll find specific verification practices, governance controls, and refere
IncidentGoogle s Threat Intelligence Group has documented a zero-day exploit that shows signs of AI-assisted development. This exploit was deployed by a criminal group against a popular open-source web-based
GeneralYou ve probably heard the warnings: AI code generators are security nightmares waiting to happen. Your developers are using Cursor or similar tools to generate entire functions in seconds, and suddenl
IncidentWhat Happened Intruder s security team scanned over 1 million exposed AI services across the public internet, uncovering widespread security failures in AI infrastructure. The scan revealed that 31% o
GeneralWhen the Linux Foundation adopted the Model Context Protocol (MCP) under the newly formed Agentic AI Foundation in late 2025, your security channels likely buzzed with speculation. Some teams dismisse
IncidentSummary of the Incident Between late February and early March 2026, attackers published five malicious Rust crates to crates.io disguised as time utility libraries. These packages executed code during
IncidentYou re building an AI coding agent using GitHub s MCP Server. Your agent needs database credentials to run queries, so you hardcode them in the server configuration. Within hours, those credentials ar
IncidentA contact form shouldn t give an attacker root access to your automation server. But in n8n versions prior to 2.10.1, that s exactly what could happen. Let s walk through how CVE-2026-27577 and CVE-20
GuidesYour developers are already using AI coding assistants. Some of these assistants connect to external servers through Model Context Protocol (MCP). You likely have no visibility into which servers they
IncidentOn March 17, 2025, security researchers at Cyera disclosed CVE-2026-7482 , a critical vulnerability in Ollama that allowed attackers to extract arbitrary memory contents from running AI models. The fl
IncidentWhat Happened In August 2025, threat actor UNC6426 compromised the nx npm package, gaining full AWS administrator access within 72 hours. The attack began with a vulnerable pull_request_target workflo
IncidentOn May 1, 2026, attackers began exploiting CVE-2026-29014 , a PHP code injection vulnerability in MetInfo CMS with a CVSS score of 9.8. This flaw allows unauthenticated remote code execution, giving a
