Expert perspectives on application security, compliance, and emerging threats
ResearchDiscover tactics behind npm supply chain attacks targeting crypto and Web3 teams. Learn verification and security steps to protect your AI and npm dependencies.
ResearchOn September 16, two GitHub Actions repositories involved in the Mini Shai-Hulud supply-chain attack were reactivated with their malicious payloads intact. They remained compromised for nine days. If
ResearchYour development team adopted AI coding assistants six months ago. Velocity increased, developers are happy, and you ve seen no obvious security incidents. But here s what you probably don t know: tho
ResearchA Harvard Business School study tracking GitHub activity reveals something your security team needs to see: developers using Copilot increased their coding time by 12.4%, while their project managemen
Get weekly security insights and compliance updates delivered to your inbox.
ResearchResearch presented at RSAC 2026 highlights a significant issue: Model Context Protocol (MCP) introduces architectural vulnerabilities in LLM environments that can t be resolved with patches. Unlike a
ResearchYou ve got three AI-powered application security scanners running against your codebase. Scanner A flags 127 issues. Scanner B finds 89. Scanner C reports 156. They agree on exactly 5% of their findin
ResearchYour developers are installing AI coding assistants that execute with full system permissions. No runtime checks. No sandboxing. Just direct access to everything on their machines. Mobb.ai s recent au
ResearchWhen you deploy an AI bot into production, you re making an implicit promise about where the security boundary lies. Does each bot instance run with unique credentials? Does a compromise affect one us
ResearchThe Internet Bug Bounty program has paused payouts after awarding over $1.5 million since 2012. The reason? AI-assisted research is transforming the landscape. This means your security team will face
ResearchYour AI coding assistant just added 47 dependencies to your project. You approved the PR because the feature works and the tests pass. Three months later, you re patching a critical vulnerability in a
ResearchIf your team installs packages from public registries, you need a systematic way to catch trojanized dependencies before they reach production. The recent RedC2 4.0 campaign, where attackers published
ResearchThe Challenge On August 15, 2026, OpenSourceMalware discovered 16 malicious packages in the RubyGems repository, all designed to steal browser credentials and cryptocurrency wallets. The attackers did
ResearchA research team decoded 315,320 thinking blocks from 6,708 public agent trajectories and recovered 704 distinct privacy artifacts, including 62 API keys and 33 passwords, from OpenAI, Anthropic, and G
ResearchIf your security team is evaluating AI-powered vulnerability scanners or has already deployed one, you need a framework for effective human-AI collaboration. This checklist ensures you re enhancing hu
ResearchSonatype Research Labs has uncovered a threat your dependency scanning tools might miss: malware using Ethereum blockchain transactions to locate command-and-control servers. Six npm packages employed
ResearchYour developers install extensions without asking. You can t stop them, but you can audit what they re running before those extensions phone home with your API keys. The Solidity Pro extensions that b
