Expert perspectives on application security, compliance, and emerging threats
IncidentImagine running npm install on a trusted package, only to find your AWS credentials are being sent to an attacker s server. This nightmare became a reality for teams using any of 1,300 compromised npm
IncidentOn August 5, 2026, PromptArmor disclosed an unpatched vulnerability in Atlassian s Rovo AI assistant. This flaw allows attackers to extract Jira and Confluence data through instructions embedded in co
IncidentOn July 30, a critical vulnerability in Ruby on Rails Active Storage turned every image upload endpoint into a potential remote code execution vector. CVE-2026-66066 , scored 9.5 out of 10, allowed at
IncidentWhat Happened Metabase disclosed a SQL injection vulnerability (CVE-2025-0005) with a CVSS score of 10.0 that was exploited before patches were available. The vulnerability affects Metabase versions 1
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn January 13, 2025, Metabase disclosed a zero-day vulnerability that allowed unauthenticated attackers to gain full administrative access to self-hosted instances. This flaw, with a CVSS score of 10.
IncidentVulnerability Overview AI browsers from leading vendors are vulnerable to prompt injection attacks, despite multiple security measures. These attacks let malicious actors manipulate AI browsing featur
IncidentOn February 11, 2025, CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog. Within 48 hours, security researchers recorded 650 exploitation attempts from 244 unique IP addresses tar
IncidentWhat Happened Between October and December 2024, attackers used stolen npm credentials to publish malicious versions of over 400 packages. These releases contained a variant of the Mini Shai-Hulud cre
IncidentSecurity researchers at Oligo Security have uncovered a threat actor, TeamPCP, that has been active since 2020. Initially targeting infrastructure like Redis, Docker, and Kubernetes, they ve now shift
IncidentA malicious agent configuration file shouldn t give an attacker root access to your control plane. But in Paperclip s case, it did exactly that. What Happened Oasis Security disclosed two critical vul
IncidentAn attacker can take over your WordPress site without knowing a single password. That s the reality of CVE-2026-64638, a pre-authentication cross-site scripting vulnerability affecting all WordPress v
IncidentOn March 24, 2026, two malicious versions of LiteLLM, 1.82.7 and 1.82.8, appeared on PyPI. This package, which routes API calls across multiple LLM providers, was compromised by TeamPCP, a group targe
IncidentWhat Happened On July 17, 2026, IBM disclosed CVE-2026-9198 , a critical remote code execution vulnerability in Langflow, its open-source AI workflow automation platform. This flaw allows attackers to
IncidentWhat Happened PortSwigger s HTTP Terminator, an AI-assisted vulnerability research system, identified a zero-day vulnerability in Apache Traffic Server while testing HTTP desynchronization techniques.
IncidentOn August 5, Novee Security demonstrated at Black Hat USA how two widely used AI coding assistants could leak CI/CD secrets through a simple attack: a crafted GitHub issue. Both Anthropic s Claude Cod
IncidentOn August 4, 2026, the Shai-Hulud malware campaign struck npm, infecting packages in the keyv and cacheable ecosystems. By the time Sonatype s research team flagged it, 2,225 component versions were c
