Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened In early 2026, Searchlight Cyber discovered two critical remote code execution vulnerabilities in WordPress Core, tracked as CVE-2026-63030 and CVE-2026-60137. These vulnerabilities, kno
IncidentOn January 29, 2025, the WordPress security team disclosed two high-severity vulnerabilities affecting WordPress 6.9 and the 7.1 beta release. Both issues, tracked as CVE-2026-60137 and CVE-2026-63030
IncidentOn July 18, 2026, WordPress released emergency patches for versions 6.9 and 7.0 to fix a critical remote code execution vulnerability. The flaw, known as wp2shell, combines CVE-2026-63030 and CVE-2026
IncidentWhat Happened Between March and June 2026, OWASP CVE Lite CLI went from initial release to Lab Project status in just three months. The tool accumulated 621 GitHub stars, over 100 forks, and more than
Get weekly security insights and compliance updates delivered to your inbox.
IncidentBetween June 29 and July 3, 2026, a threat actor published seven malicious npm packages targeting developers using Vite, a popular frontend build tool. Checkmarx discovered the campaign, dubbed ViteVe
IncidentA Go-based botnet named NadMesh has been actively scanning for exposed AI services and harvesting cloud credentials. Research from QiAnXin s XLab reveals that the botnet s operator claims to have coll
GeneralYour web agents can read natural language. So can attackers. Cross-Site Prompting (XSP) exploits the same trust boundary weakness as Cross-Site Scripting, but instead of injecting JavaScript, attacker
DeadlinesYour Kubernetes controllers worked fine at 50 nodes. Now you re planning for 5,000, and you need to ensure they won t crash, leak resources, or create security gaps. This checklist walks through the o
IncidentWhat Happened OpenAI s automated red-teaming system, GPT-Red, successfully attacked a production AI agent and convinced it to reprice inventory. Items normally priced above $100 were marked down to $0
GeneralYou ve locked down your API keys, you re running static analysis on your codebase, and your network security team has implemented zero trust for human users. When your engineering team proposes deploy
IncidentWhat Happened Bugcrowd recently revised its submission policies after a surge of low-quality, AI-generated vulnerability reports. Researchers submitted findings that looked polished but lacked proof t
IncidentThe Problem In 2024, CISA and four international cybersecurity agencies released joint guidance urging software vendors to establish formal coordinated vulnerability disclosure (CVD) programs. This wa
IncidentOn June 24, 2026, n8n patched CVE-2026-59208, a vulnerability in their token exchange mechanism that allowed attackers to authenticate as users from a different token issuer. If your Enterprise instan
GeneralThe Conventional Wisdom Security teams are rushing to buy AI agent security platforms. The pitch sounds reasonable: AI agents move too fast for humans to monitor, they access systems autonomously, and
IncidentSAP s July 2026 security update included CVE-2026-44747 , an out-of-bounds write vulnerability in NetWeaver Application Server ABAP with a CVSS score of 9.9. This flaw allows an authenticated attacker
IncidentWhat Happened OpenAI used GPT-Red, an automated adversarial testing system, to identify prompt injection vulnerabilities in GPT-5.6 Sol before its release. The testing showed that earlier versions wer
