Expert perspectives on application security, compliance, and emerging threats
IncidentA malicious agent configuration file shouldn t give an attacker root access to your control plane. But in Paperclip s case, it did exactly that. What Happened Oasis Security disclosed two critical vul
IncidentAn attacker can take over your WordPress site without knowing a single password. That s the reality of CVE-2026-64638, a pre-authentication cross-site scripting vulnerability affecting all WordPress v
IncidentOn March 24, 2026, two malicious versions of LiteLLM, 1.82.7 and 1.82.8, appeared on PyPI. This package, which routes API calls across multiple LLM providers, was compromised by TeamPCP, a group targe
IncidentWhat Happened On July 17, 2026, IBM disclosed CVE-2026-9198 , a critical remote code execution vulnerability in Langflow, its open-source AI workflow automation platform. This flaw allows attackers to
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened PortSwigger s HTTP Terminator, an AI-assisted vulnerability research system, identified a zero-day vulnerability in Apache Traffic Server while testing HTTP desynchronization techniques.
IncidentOn August 5, Novee Security demonstrated at Black Hat USA how two widely used AI coding assistants could leak CI/CD secrets through a simple attack: a crafted GitHub issue. Both Anthropic s Claude Cod
IncidentOn August 4, 2026, the Shai-Hulud malware campaign struck npm, infecting packages in the keyv and cacheable ecosystems. By the time Sonatype s research team flagged it, 2,225 component versions were c
IncidentA critical vulnerability in JetBrains TeamCity (CVE-2026-63077) is being actively exploited. CISA added it to the Known Exploited Vulnerabilities catalog and issued Binding Operational Directive (BOD)
IncidentWhat Happened A public-facing web application with a SQL injection vulnerability became the entry point for an attack that ended with SYSTEM-level code execution on a Windows server. The attackers did
IncidentWhat Happened Attackers exploited a SQL injection vulnerability to access an Oracle Database and used its Java capabilities to install a custom toolkit called Khunt. They used Oracle s CREATE JAVA SOU
IncidentOn July 27, 2026, Huntress discovered an attack that should change how you think about database security. Hackers didn t just steal data from an Oracle database, they turned the database itself into a
IncidentWhat Happened In February 2026, Microsoft Security documented a new attack called AI Recommendation Poisoning. This technique exploits Ask AI buttons on websites, which let users query ChatGPT, Claude
IncidentWhat Happened In late 2024, researchers at 1Password evaluated AI-generated vulnerability patches across six recently disclosed CVEs. They generated 6,080 patches using leading AI models and subjected
IncidentBetween late 2024 and early 2025, security researchers disclosed vulnerabilities in AWS Bedrock, Google s Agent Development Kit, and Vercel s AI SDK. These flaws allowed attackers to trigger tool exec
IncidentBetween late January and early February 2025, an automated malware campaign called Flooding Dropper released 850 malicious packages onto npm. Sonatype Research Labs is tracking this as sonatype-2026-0
IncidentAn attacker can seize control of an AI browser agent without any user interaction. The exploit, called PleaseFix, embeds malicious instructions directly into web content that the AI agent processes. W
