Expert perspectives on application security, compliance, and emerging threats
IncidentOver 850 GitHub accounts were compromised through malicious CI/CD workflows that bypass secret masking and exfiltrate credentials via GitHub's API.
ResearchFive days after PHP2Shell disclosure, 93.6% of PHP systems remained vulnerable due to common patching mistakes that hinder swift remediation.
IncidentThousands of developer repositories are compromised by attackers exploiting exposed GitHub tokens, leading to widespread data exfiltration and security risks.
IncidentThe PHP2Shell breach exposed vulnerabilities in 37 million internet-facing PHP systems, highlighting risks to critical infrastructure from AI-driven attacks.
Get weekly security insights and compliance updates delivered to your inbox.
IncidentA critical memory-corruption flaw in Google's Brotli decoder led to over 50 patches across platforms, exposing challenges in managing bundled open-source dependencies.
IncidentPHP's CVE-2026-115560 RCE vulnerability requires specific config failures. Without patches, organizations must enforce secure PHP baselines and rapid mitigation.
IncidentTwo critical PHP RCE vulnerabilities allow unauthenticated remote code execution, exposing failures in asset inventory, change management, and patching speed.
IncidentIn 2026, AI tools uncovered critical PHP vulnerabilities faster than maintainers could patch, exposing systemic risks and challenging traditional open-source security models.
IncidentTwo critical PHP zero-day RCE vulnerabilities emerged in 2025, impacting all versions before 8.2. AI accelerated exploit discovery, shrinking patch windows dangerously.
IncidentDiscover how OVHcloud's 94-minute release hijack highlights the critical need for release immutability and hash verification to prevent supply chain attacks.
ResearchDiscover tactics behind npm supply chain attacks targeting crypto and Web3 teams. Learn verification and security steps to protect your AI and npm dependencies.
IncidentOn October 15, unauthorized authentication attempts hit ConnectWise s Cloud Backup service. Within hours, attackers had compromised at least 162 Microsoft 365 tenants. They didn t crack passwords or b
IncidentA hallucinated URL in OpenAI s official skills repository directed AI agents to send data to an unclaimed domain for seven months. This vulnerability, present from January through mid-August 2024, exp
IncidentWhat Happened In late 2024, an attacker uploaded hundreds of malicious packages to the Arch User Repository (AUR), targeting users who mistyped popular AUR helper names. One such package, yyay , mimic
IncidentOn September 10, 2026, attackers exploited a critical flaw in Collabora Online s Built-in CODE Server app for Nextcloud . This vulnerability allowed unauthenticated attackers to plant web shells on se
IncidentOn September 8, Artifex Software released Ghostscript version 10.08.0. Among the updates was a fix for CVE-2026-39919 , a heap buffer overflow that allows attackers to execute arbitrary code by upload
