Expert perspectives on application security, compliance, and emerging threats
IncidentBetween late 2024 and early 2025, four malicious npm packages delivered the Shai-Hulud infostealer to developer machines. These packages—typosquats of legitimate tools—were downloaded 2,678 times befo
IncidentBetween late 2024 and early 2025, four malicious packages appeared on the npm registry and accumulated 3,006 downloads before removal. One package, chalk-tempalte (note the misspelling), contained a d
IncidentWhat Happened CVE-2026-42897 , a cross-site scripting (XSS) vulnerability in Microsoft Exchange s Outlook Web Access (OWA), is being actively exploited with no patch available. Attackers can compromis
IncidentOn February 19, 2025, Microsoft and the Institute of Science Tokyo published research documenting a new class of AI model backdoor that bypasses every content-based security control you re running. Th
Get weekly security insights and compliance updates delivered to your inbox.
IncidentBetween January 14 and January 24, 2026, five enterprise software vendors released patches for critical vulnerabilities with CVSS scores ranging from 9.1 to 9.6. If your team manages any combination o
IncidentWhat Happened Between late 2024 and early 2025, three separate credential-harvesting campaigns targeted npm , PyPI, and Docker Hub within a 48-hour period. These attacks followed a common pattern: com
IncidentA research team at Xidian University has demonstrated a new type of attack that manipulates multimodal AI systems through altered images. This attack, called CrossMPI, achieved a 66.36% average succes
GeneralAgentic AI systems are operating in production—processing emails, writing code, booking meetings—and many security teams lack a framework to evaluate their risks. The issue isn t about tools; it s abo
GeneralScope - What This Guide Covers This guide shows you how to use custom scan checks in Burp Suite to automate security expertise across your application portfolio. You ll learn to: Build checks that res
GuidesYour pentest vendor sends a 47-page PDF. Your team triages it into Jira tickets. Developers ask clarifying questions via Slack. The vendor responds three days later via email. By the time you verify t
GeneralYour AI deployment just provisioned 47 service accounts. None of them have owners, none log what they access, and three have write access to your production database. This isn t a hypothetical breach
GeneralStraiker s red team discovered 87 exploits across production AI agents, with 24 instances following a pattern called Living Off The Agent (LOTA). If you re deploying autonomous AI agents, your traditi
GuidesYour team adopted Burp Suite six months ago to enhance your web application security testing as part of your SOC 2 Type II preparation. Yet, your scans keep missing SQL injection vulnerabilities that
IncidentWhat Happened Attackers are actively exploiting CVE-2026-42945 , a heap buffer overflow in NGINX s ngx_http_rewrite_module . VulnCheck detected exploitation attempts against their honeypot networks. T
IncidentWhat Happened The DARPA Artificial Intelligence Cyber Challenge (AIxCC) concluded with a $30,500,000 prize pool, showcasing AI s potential in vulnerability detection. Seven teams deployed AI systems a
ResearchYour team ships code 55% faster with AI assistance. But when that code breaks in production at 2 AM, can they fix it? This isn t a hypothetical problem. According to Octopus Deploy research, 73% of or
