Expert perspectives on application security, compliance, and emerging threats
StandardsYour security measures are outdated for a development process that has evolved. When AI agents continuously write code—not in sprints or releases—traditional security practices like quarterly pen test
ResearchYour SAST scanner flags 47 critical vulnerabilities overnight. Your SCA tool adds 23 more. Your IaC scanner contributes another 15. By 9 AM, you re staring at 85 critical findings, and you know from e
StandardsThe Challenge Anthropic s Claude Code Security identified over 500 previously unknown high-severity vulnerabilities in open-source codebases. While this might seem like a win for security teams, it pr
IncidentOverview of Findings Security researchers at Wiz spent two years examining AI infrastructure deployments to uncover exploitable vulnerabilities. Their findings reveal that while many teams focus on pr
Get weekly security insights and compliance updates delivered to your inbox.
StandardsYour AI coding assistant just installed a malicious package. Not because it s compromised—because it made a typo. The SANDWORM_MODE campaign shows how AI tools like Claude Code and OpenClaw have becom
GuidesSecurity teams invest significant time building threat intelligence feeds, vulnerability scanners, and policy engines, only to see developers overlook them due to separate dashboards and context-switc
IncidentIncident Overview Orca Security discovered RoguePilot, a vulnerability in GitHub Codespaces that allowed attackers to manipulate GitHub Copilot into leaking GITHUB_TOKEN credentials. Attackers embedde
GeneralThe AI Cyber Challenge concluded after two years of competition between DARPA, ARPA-H, and OpenSSF. Now, teams are assessing what their cyber reasoning systems can achieve in real-world environments.
ResearchThe Question at Hand Your security team has flagged a new AI automation framework in your environment. It s early-stage, popular in the community, and there s no confirmed exploitation yet. Should you
IncidentThe Challenge A financial services organization believed they had a robust security architecture with WAFs , application-layer security controls, runtime protection, and comprehensive monitoring. Howe
GeneralYour cloud environment contains more service accounts, API keys, and bot credentials than employee logins—and most security teams can t inventory them. This shift in identity architecture fundamentall
StandardsLast month, an AI system identified twelve zero-day vulnerabilities in OpenSSL—ten assigned CVE-2025 identifiers and two CVE-2026 identifiers. Five of those findings came with AI-proposed patches that
IncidentAttack Overview Attackers have targeted government and public-sector organizations by exploiting OAuth 2.0 s error handling mechanisms. The attack began with phishing emails containing malicious links
StandardsWhen OpenClaw patched the ClawJacked vulnerability within 24 hours of disclosure, they acted swiftly. If you re running AI agents—whether OpenClaw, AutoGPT, LangChain agents, or custom implementations
StandardsThe release candidate of ASVS 5.0 was announced on April 9, 2025. You have a limited opportunity to influence what becomes the benchmark for application security verification. Elar Lang will present t
IncidentWhat Happened On February 17, 2026, an attacker exploited a compromised npm publish token to release Cline CLI version 2.3.0, an unauthorized update that installed OpenClaw on developer systems. This
