Expert perspectives on application security, compliance, and emerging threats
IncidentSecureLayer7 released Sandyaa in late 2024 under an MIT license. This tool uses large language models to scan source code for vulnerabilities and then writes exploit code to prove they re real. Within
GeneralGitHub forecasts 14 billion commits in 2026—a 10x increase from pre-AI levels. Your security team is already feeling it. Pull requests arrive faster, code reviews pile up, and the quality of code comi
IncidentA critical authentication bypass in the Burst Statistics WordPress plugin gave attackers admin-level access to thousands of websites. Here s what happened, which controls failed, and what your team ne
ResearchImagine your team just renewed all your domains. Six months later, one expires because the credit card on file failed. A week after that, someone else registers it. They now control a domain that your
Get weekly security insights and compliance updates delivered to your inbox.
GeneralScope - What This Guide Covers This guide focuses on the operational changes in application security as AI agents take on end-to-end vulnerability management. It provides frameworks for establishing g
IncidentWhat Happened Between early December 2024 and January 16, 2025, attackers exploited a critical vulnerability in FunnelKit s Funnel Builder plugin to inject malicious JavaScript into WooCommerce checko
IncidentDiscovery of a Long-Overlooked Vulnerability An AI-powered security agent uncovered a vulnerability that had eluded human researchers for over a decade, exploiting it within 48 hours of deployment. Th
IncidentWhat Happened TeamPCP compromised Mistral AI s codebase management system, extracting nearly 450 repositories. They are selling the complete source code for $25,000 on underground forums, threatening
IncidentWhat Happened In early 2025, threat actor TeamPCP compromised TanStack s distribution infrastructure and released trojanized versions of npm and PyPI SDKs. Two OpenAI employee devices installed these
IncidentWhat Happened On May 12, Wordfence disclosed two vulnerabilities in the Avada Builder WordPress plugin, which has an estimated one million active installations. CVE-2026-4782 allows arbitrary file rea
IncidentA vulnerability in the Funnel Builder WordPress plugin allowed attackers to inject malicious JavaScript into WooCommerce checkout pages and harvest credit card data in real time. The plugin, active on
IncidentDiscovery of a Long-Standing Vulnerability In early 2025, DepthFirst AI discovered CVE-2026-42945, a heap buffer overflow vulnerability in Nginx s ngx_http_rewrite_module . This flaw had existed undet
IncidentWhat Happened On March 7, 2025, security researchers at Socket detected malicious code in three versions of node-ipc , an npm package with more than 690,000 weekly downloads. The compromised versions—
IncidentYour SIEM flagged an anomaly in authentication patterns. You asked your AI security assistant to investigate. It analyzed the logs, identified what it called malicious bot traffic, and recommended imm
ResearchAbout six months ago, questions began surfacing in our Slack channels as teams started deploying RAG pipelines to production. A security engineer discovered that their vector database contained custom
IncidentWhat Happened In early 2025, security researchers at DepthFirst AI discovered CVE-2026-42945 , a vulnerability that had existed in NGINX for 18 years. The flaw affects NGINX versions 0.6.27 through 1.
