Expert perspectives on application security, compliance, and emerging threats
GeneralYou re reviewing more pull requests than ever. Your team s throughput has doubled, and you re catching issues you ve never seen before: logic errors that compile cleanly, API calls that look right but
IncidentWhat Happened Internet-wide scanning has revealed 175,000 Ollama servers with publicly accessible APIs. Ollama, a tool for running large language models locally or on cloud infrastructure, exposes a R
IncidentA supply chain attack compromised 19 Chrome and Edge extensions between December 2024 and January 2025. Attackers acquired legitimate extensions, pushed malicious updates through official channels, an
GeneralScope This guide addresses the perception gap between executive leadership and security practitioners on AI system security. It s designed for security engineers who need to: Translate technical AI se
Get weekly security insights and compliance updates delivered to your inbox.
ResearchYou ve got three AI-powered application security scanners running against your codebase. Scanner A flags 127 issues. Scanner B finds 89. Scanner C reports 156. They agree on exactly 5% of their findin
GeneralScope This guide focuses on managing the security of transitive dependencies, the indirect libraries your direct dependencies pull in. You ll learn how to identify these hidden components, assess thei
GeneralYour security team might be debating the wrong issue about AI-generated code. The real question isn t whether you need new testing methods for AI-written code versus human-written code. It s whether y
IncidentOn January 16, 2025, security researchers disclosed a vulnerability in the GiveWP WordPress plugin that earned a perfect 10.0 CVSS score. CVE-2026-82222 joins four other critical flaws affecting widel
IncidentWhat Happened Google has announced it will no longer accept AI-generated submissions to its Open Source Software Vulnerability Reward Program (VRP). This decision follows a trend of low-quality report
ResearchYour developers are installing AI coding assistants that execute with full system permissions. No runtime checks. No sandboxing. Just direct access to everything on their machines. Mobb.ai s recent au
GeneralMost security teams treat secrets rotation as a solved problem. You ve got a vault, set rotation policies, and automated the process. Box checked. But here s the uncomfortable truth: you re spending e
IncidentThe XM Cyber threat research team identified eight distinct attack vectors in AWS Bedrock environments. None of these exploits rely on zero-days or novel techniques. They all hinge on a single point o
IncidentServiceNow disclosed three critical vulnerabilities in its AI Platform on January 14, 2025. All three received CVSS scores at maximum severity. The flaws, CVE-2026-18885 (code injection), CVE-2026-188
IncidentWhat Happened ServiceNow patched three critical vulnerabilities in its AI Platform that allowed unauthenticated attackers to execute arbitrary code and SQL statements without user interaction. The vul
IncidentIn April 2026, NIST reclassified roughly 30,000 vulnerabilities in the National Vulnerability Database as Not Scheduled. If your team relied on NVD as your single source of truth, you just lost visibi
IncidentAn unauthenticated attacker just created an admin account on a nonprofit s WordPress site. They didn t need credentials or exploit a complex chain. They sent a single HTTP request to a donation form.
