Expert perspectives on application security, compliance, and emerging threats
IncidentOver 850 GitHub accounts were compromised through malicious CI/CD workflows that bypass secret masking and exfiltrate credentials via GitHub's API.
IncidentThousands of developer repositories are compromised by attackers exploiting exposed GitHub tokens, leading to widespread data exfiltration and security risks.
IncidentThe PHP2Shell breach exposed vulnerabilities in 37 million internet-facing PHP systems, highlighting risks to critical infrastructure from AI-driven attacks.
IncidentA critical memory-corruption flaw in Google's Brotli decoder led to over 50 patches across platforms, exposing challenges in managing bundled open-source dependencies.
Get weekly security insights and compliance updates delivered to your inbox.
IncidentPHP's CVE-2026-115560 RCE vulnerability requires specific config failures. Without patches, organizations must enforce secure PHP baselines and rapid mitigation.
IncidentTwo critical PHP RCE vulnerabilities allow unauthenticated remote code execution, exposing failures in asset inventory, change management, and patching speed.
IncidentIn 2026, AI tools uncovered critical PHP vulnerabilities faster than maintainers could patch, exposing systemic risks and challenging traditional open-source security models.
IncidentTwo critical PHP zero-day RCE vulnerabilities emerged in 2025, impacting all versions before 8.2. AI accelerated exploit discovery, shrinking patch windows dangerously.
IncidentDiscover how OVHcloud's 94-minute release hijack highlights the critical need for release immutability and hash verification to prevent supply chain attacks.
IncidentOn October 15, unauthorized authentication attempts hit ConnectWise s Cloud Backup service. Within hours, attackers had compromised at least 162 Microsoft 365 tenants. They didn t crack passwords or b
IncidentA hallucinated URL in OpenAI s official skills repository directed AI agents to send data to an unclaimed domain for seven months. This vulnerability, present from January through mid-August 2024, exp
IncidentWhat Happened In late 2024, an attacker uploaded hundreds of malicious packages to the Arch User Repository (AUR), targeting users who mistyped popular AUR helper names. One such package, yyay , mimic
IncidentOn September 10, 2026, attackers exploited a critical flaw in Collabora Online s Built-in CODE Server app for Nextcloud . This vulnerability allowed unauthenticated attackers to plant web shells on se
IncidentOn September 8, Artifex Software released Ghostscript version 10.08.0. Among the updates was a fix for CVE-2026-39919 , a heap buffer overflow that allows attackers to execute arbitrary code by upload
IncidentAttackers are actively exploiting a critical SSRF vulnerability in SonicWall SMA 1000 appliances. This isn t a theoretical risk. It s happening now, and if you re running these devices, you need to un
IncidentThe Problem Researchers at Northwestern University have discovered a significant issue with AI coding agents. While these tools can prevent program crashes, they often fail to meet the requirements se
