Expert perspectives on application security, compliance, and emerging threats
GeneralWhat Changed Your code review process just broke. Engineers are reviewing 500-line diffs generated by AI at a pace that makes careful reading impossible. The traditional line-by-line review model assu
GeneralThe Conventional Wisdom We ll migrate to the new EKS access API when we have time. The aws-auth ConfigMap still works, and we ve got bigger security problems to solve. You ve heard this. Maybe you ve
GeneralGoogle s Customer Support Returns Agent can issue refunds. Without proper controls, it could process a $10,000 refund instead of $149. You wouldn t give a contractor root access to your production dat
IncidentWhat Happened Google s Mandiant used an AI-driven tool called the Agentic Vulnerability Discovery Harness (AVDH) to scan production codebases. In just two days, it found over 100 verified, high-severi
Get weekly security insights and compliance updates delivered to your inbox.
ResearchThe Challenge On August 15, 2026, OpenSourceMalware discovered 16 malicious packages in the RubyGems repository, all designed to steal browser credentials and cryptocurrency wallets. The attackers did
IncidentYour MLflow instances are leaking cloud credentials right now. Attackers aren t waiting for you to patch CVE-2026-64849. They re already inside, targeting the metadata endpoints that hand over AWS key
IncidentA crafted URL could silently execute prompts in Microsoft Copilot Personal and exfiltrate data from any connected application, no user interaction required beyond clicking a link. Varonis Threat Labs
IncidentA zero-click remote code execution vulnerability in GitLab s self-managed instances highlights a critical gap in how your team prepares for urgent patches. When you can t detect exploitation and have
IncidentWhat Happened In January 2025, GitLab disclosed a critical vulnerability (CVE-2026-19478) that allowed unauthenticated attackers to modify or delete public repositories with a single HTTP request. Thi
IncidentThe Issue at Hand Between 2023 and 2024, organizations using AI code generation noticed a troubling trend: the same AI models that excel at finding vulnerabilities were also introducing security flaws
IncidentIn December 2020, security teams discovered that attackers had compromised SolarWinds Orion platform and distributed malicious updates to roughly 18,000 customers. The breach went undetected for month
IncidentWhat Happened On June 23, 2026, Wiz disclosed a command injection vulnerability in Snowflake s public GitHub repository. This flaw allowed attackers to execute arbitrary commands through crafted GitHu
GeneralYou re running a secret scanner. You ve got pre-commit hooks. Your CI pipeline blocks obvious API keys. So you re covered, right? Not quite. Teams often discover production credentials in public repos
IncidentOn December 11, 2024, SAP released patches for CVE-2026-58231, a vulnerability in SAP Commerce Cloud with a CVSS score of 10.0. By December 14, attackers were already probing exposed instances. If you
GeneralScope This guide focuses on secrets management for environments where AI agents access enterprise systems through Model Context Protocol (MCP) servers. You ll find guidance for securing credentials, A
IncidentOn a Tuesday outside GitLab s normal patch cycle, security teams running self-managed instances faced a choice: patch immediately or risk losing public projects to unauthenticated attackers. CVE-2026-
