Expert perspectives on application security, compliance, and emerging threats
IncidentOver 850 GitHub accounts were compromised through malicious CI/CD workflows that bypass secret masking and exfiltrate credentials via GitHub's API.
IncidentThousands of developer repositories are compromised by attackers exploiting exposed GitHub tokens, leading to widespread data exfiltration and security risks.
IncidentThe PHP2Shell breach exposed vulnerabilities in 37 million internet-facing PHP systems, highlighting risks to critical infrastructure from AI-driven attacks.
IncidentPHP's CVE-2026-115560 RCE vulnerability requires specific config failures. Without patches, organizations must enforce secure PHP baselines and rapid mitigation.
Get weekly security insights and compliance updates delivered to your inbox.
IncidentTwo critical PHP RCE vulnerabilities allow unauthenticated remote code execution, exposing failures in asset inventory, change management, and patching speed.
IncidentIn 2026, AI tools uncovered critical PHP vulnerabilities faster than maintainers could patch, exposing systemic risks and challenging traditional open-source security models.
IncidentTwo critical PHP zero-day RCE vulnerabilities emerged in 2025, impacting all versions before 8.2. AI accelerated exploit discovery, shrinking patch windows dangerously.
IncidentOn October 15, unauthorized authentication attempts hit ConnectWise s Cloud Backup service. Within hours, attackers had compromised at least 162 Microsoft 365 tenants. They didn t crack passwords or b
IncidentA hallucinated URL in OpenAI s official skills repository directed AI agents to send data to an unclaimed domain for seven months. This vulnerability, present from January through mid-August 2024, exp
IncidentWhat Happened In late 2024, an attacker uploaded hundreds of malicious packages to the Arch User Repository (AUR), targeting users who mistyped popular AUR helper names. One such package, yyay , mimic
IncidentOn September 10, 2026, attackers exploited a critical flaw in Collabora Online s Built-in CODE Server app for Nextcloud . This vulnerability allowed unauthenticated attackers to plant web shells on se
IncidentOn September 8, Artifex Software released Ghostscript version 10.08.0. Among the updates was a fix for CVE-2026-39919 , a heap buffer overflow that allows attackers to execute arbitrary code by upload
IncidentAttackers are actively exploiting a critical SSRF vulnerability in SonicWall SMA 1000 appliances. This isn t a theoretical risk. It s happening now, and if you re running these devices, you need to un
IncidentThe Problem Researchers at Northwestern University have discovered a significant issue with AI coding agents. While these tools can prevent program crashes, they often fail to meet the requirements se
IncidentWhat Happened A vulnerability in AWS Bedrock AgentCore allowed attackers to escalate from a single compromised AI chatbot to full control of an organization s AWS environment. The flaw, discovered by
IncidentBetween August 2023 and now, eight malicious npm packages accumulated 40,767 downloads, delivering Overlord RAT and information stealers to developer workstations. One package, function-flag , account
