Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened During DARPA s Artificial Intelligence Cyber Challenge (AIxCC), Team Atlanta deployed OSS-CRS, an AI-driven system designed to automatically detect and patch vulnerabilities in open sour
IncidentWhat Happened A mid-market organization tracked 847 vulnerabilities across their environment. Over three months, they reduced this number to 623. The security team celebrated the progress. However, an
IncidentThe Breach Overview A financial services organization faced a major security breach when a single stolen credential led to domain-wide access. The initial entry point seemed minor: one set of credenti
IncidentYou deployed a fix for Log4Shell in December 2021. Your scanners showed clean. Three months later, an attacker used the same vulnerability to compromise a legacy microservice you forgot was still runn
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn a Tuesday, SAP released patches for CVE-2026-58231, a remote code execution vulnerability in Commerce Cloud with a CVSS score of 10.0. By Friday, threat intelligence firm Defused confirmed active e
IncidentIn February 2024, JFrog researchers discovered a weaponized PyTorch model on Hugging Face that opened a reverse shell on any system that loaded it. The model sat in a public repository, unsigned and u
IncidentWhat Happened On December 18, 2024, a zero-day SQL injection vulnerability in GeoServer s jsonArrayContains function was publicly disclosed on social media. This flaw lets unauthenticated attackers in
IncidentThe Problem A security team recently completed a major remediation effort, closing 251 vulnerability tickets across their application portfolio. They achieved 98% patch compliance, and the dashboard s
IncidentOn January 14, 2025, Rapid7 Labs disclosed a critical exploit chain targeting Microsoft SharePoint Server. The chain combines CVE-2026-55040 (CVSS 9.1, JWT authentication bypass) and CVE-2026-63520 (r
IncidentOn October 13, 2026, the deadline for NIST s Request for Information (RFI) will close. If your team hasn t submitted feedback yet, you re missing a key opportunity to influence the future of vulnerabi
IncidentOn December 20, 2024, developers installing LiteLLM versions 1.82.7 or 1.82.8 from PyPI unknowingly turned their workstations into credential extraction engines. The TeamPCP threat actor had compromis
IncidentA vulnerability in libpng went undetected for three decades before it was patched in February 2026. Similarly, Windows PrintDemon lingered in production code for 24 years before Microsoft addressed it
IncidentWhat Happened CVE-2026-71362 allows attackers to hijack customer accounts on Adobe Commerce and Magento platforms without authentication. Adobe released patches for this vulnerability along with fixes
IncidentOn patch Tuesday in December 2024, SAP disclosed CVE-2026-58231, a vulnerability in SAP Commerce Cloud that scored 10.0 on CVSS. This is the highest severity rating possible. An unauthenticated attack
IncidentTracebit researchers discovered something unexpected while testing AI security tools on Amazon Web Services: they could stop automated hacking agents mid-attack by placing specific text strings next t
IncidentA vulnerability in a new package just gave attackers complete access to business intelligence data across thousands of organizations. On August 6, researchers disclosed CVE-2026-72898, a SQL Injection
