Expert perspectives on application security, compliance, and emerging threats
GeneralScope This guide focuses on managing the security of transitive dependencies, the indirect libraries your direct dependencies pull in. You ll learn how to identify these hidden components, assess thei
GeneralYour security team might be debating the wrong issue about AI-generated code. The real question isn t whether you need new testing methods for AI-written code versus human-written code. It s whether y
IncidentOn January 16, 2025, security researchers disclosed a vulnerability in the GiveWP WordPress plugin that earned a perfect 10.0 CVSS score. CVE-2026-82222 joins four other critical flaws affecting widel
IncidentWhat Happened Google has announced it will no longer accept AI-generated submissions to its Open Source Software Vulnerability Reward Program (VRP). This decision follows a trend of low-quality report
Get weekly security insights and compliance updates delivered to your inbox.
ResearchYour developers are installing AI coding assistants that execute with full system permissions. No runtime checks. No sandboxing. Just direct access to everything on their machines. Mobb.ai s recent au
GeneralMost security teams treat secrets rotation as a solved problem. You ve got a vault, set rotation policies, and automated the process. Box checked. But here s the uncomfortable truth: you re spending e
IncidentThe XM Cyber threat research team identified eight distinct attack vectors in AWS Bedrock environments. None of these exploits rely on zero-days or novel techniques. They all hinge on a single point o
IncidentServiceNow disclosed three critical vulnerabilities in its AI Platform on January 14, 2025. All three received CVSS scores at maximum severity. The flaws, CVE-2026-18885 (code injection), CVE-2026-188
IncidentWhat Happened ServiceNow patched three critical vulnerabilities in its AI Platform that allowed unauthenticated attackers to execute arbitrary code and SQL statements without user interaction. The vul
IncidentIn April 2026, NIST reclassified roughly 30,000 vulnerabilities in the National Vulnerability Database as Not Scheduled. If your team relied on NVD as your single source of truth, you just lost visibi
IncidentAn unauthenticated attacker just created an admin account on a nonprofit s WordPress site. They didn t need credentials or exploit a complex chain. They sent a single HTTP request to a donation form.
GeneralOmdia s Theresa Lanowitz reports a measurable shift: organizations are accelerating investment in offensive security capabilities, specifically penetration testing and red team tools powered by agenti
IncidentWhat happened On July 27, Gitea released version 1.27.1 to patch CVE-2026-60004, a critical remote code execution vulnerability in its diffpatch API endpoint. This flaw allows attackers to execute arb
IncidentWhat Happened In early 2024, security researchers disclosed EchoLeak, a zero-click prompt injection vulnerability in Microsoft 365 Copilot with a CVSS score of 9.3. This flaw allowed attackers to mani
IncidentOn April 17, 2025, Vercel shipped emergency patches for Next.js after discovering two critical vulnerabilities that let unauthenticated attackers execute arbitrary code on affected servers. One exploi
IncidentA coordinated operation by the Australian Federal Police has led to the arrest of two individuals linked to TeamPCP, a hacking group responsible for supply-chain attacks that compromised over a thousa
