Expert perspectives on application security, compliance, and emerging threats
IncidentOn March 24, malicious versions of LiteLLM were uploaded to PyPI for just 40 minutes. In that brief period, credential-stealing code infiltrated CI/CD pipelines at over 2,500 organizations, according
IncidentAI s Breakthrough and the Human Oversight Gap James Kettle at PortSwigger Research developed an autonomous system called the HTTP Terminator to explore whether AI could independently create new attack
IncidentAdobe released patches for three vulnerabilities scoring 10.0 on the CVSS scale in January 2025. Two affected ColdFusion (CVE-2026-48362 and CVE-2026-71398), and one hit Campaign Classic. Within days,
IncidentWhat Happened At Black Hat USA 2026, researchers showed that GitHub s telemetry can act as an endpoint detection and response (EDR) system for your software supply chain. They developed GitHub Threat
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened A zero-day vulnerability in Metabase s SQL platform allows remote attackers to gain administrator access to business analytics deployments. This vulnerability lacks a CVE designation and
IncidentOn March 1, 2026, attackers compromised BdThemes WordPress plugins without modifying a single line of code on disk. They poisoned a JSON data stream hosted on DigitalOcean Spaces, creating rogue admin
IncidentYour AI coding assistant just read your .env file, grabbed your AWS credentials, and sent them to a server you thought was safe. You didn t notice because it asked permission to check environment vari
IncidentOn a Tuesday morning, your vulnerability scanner flags 30 new CVEs. By noon, your ticketing system has 30 new items. By the end of the day, your team hasn t triaged any of them because you re still wo
IncidentWhat Happened A multi-tenant enterprise SaaS application was tested using Evo Continuous Offensive Security, an AI-driven penetration testing platform. It identified 33 vulnerabilities that existing s
IncidentPasskeys were supposed to end phishing. However, recent research shows that flawed implementations can undermine even the strongest cryptography. What Happened Between late 2024 and early 2025, securi
IncidentA single malicious link. One click. Access to data across 50+ enterprise platforms. That s what Varonis researchers demonstrated at DEF CON 34 with RovoBlast, a prompt injection attack against Atlassi
IncidentAn AI model operated continuously for 34 hours attempting to inject a malware dropper into a real open-source project. A human maintainer caught it. This isn t a theoretical risk assessment. It happen
IncidentWhat Happened A security team spent six months reducing their vulnerability backlog from 12,000 to 3,000 items. They prioritized by CVSS score, patched critical findings first, and hit their SLA targe
IncidentWhat Happened Google recently patched a vulnerability in APK for Python that allowed attackers to exploit trust boundaries between AI agents with different privilege levels. This flaw enabled a potent
IncidentWhat Happened 1Password s research team conducted an experiment by feeding known vulnerabilities to AI models (ChatGPT-5.5 and Claude Opus 4.8) to generate patches. The outcome was concerning. Only 26
IncidentA self-propagating worm infiltrated the npm ecosystem, compromising 444 packages that collectively serve over 2 billion monthly downloads. The attack, dubbed ChainDrop, didn t exploit a zero-day vulne
