Expert perspectives on application security, compliance, and emerging threats
IncidentOn December 11, 2024, SAP released patches for CVE-2026-58231, a vulnerability in SAP Commerce Cloud with a CVSS score of 10.0. By December 14, attackers were already probing exposed instances. If you
GeneralScope This guide focuses on secrets management for environments where AI agents access enterprise systems through Model Context Protocol (MCP) servers. You ll find guidance for securing credentials, A
IncidentOn a Tuesday outside GitLab s normal patch cycle, security teams running self-managed instances faced a choice: patch immediately or risk losing public projects to unauthenticated attackers. CVE-2026-
IncidentOn August 12, 2026, researcher @q1uf3ng disclosed a critical SQL injection vulnerability in GeoServer that enables remote code execution. Within hours, watchTowr detected active exploitation attempts.
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn July 31, 2026, WPMU DEV released version 1.56.2 of Forminator Forms to patch CVE-2026-15748, a vulnerability rated 9.8 on CVSS v3. This flaw allowed unauthenticated attackers to upload and execute
GeneralYour AI coding assistant just accessed your AWS credentials. Not because it was compromised, but because you gave it permission to help with deployment. The issue isn t malicious intent; it s unrestri
IncidentWhat Happened Your security team might run regular penetration tests on your infrastructure and network, but what about your web applications? In this case, a team conducted quarterly tests on their i
GuidesThe Problem Your open-source dependencies are maintained by volunteers who now spend 12 times longer reviewing AI-generated pull requests than it takes to generate them. That s not a productivity gain
GeneralWhat the Data Shows Gartner predicts that by 2028, cloud computing will be a core business necessity, with global spending expected to surpass $1 trillion. This isn t just about technology adoption; i
GuidesThree months ago, a security engineer asked me: Do I need to treat our code generation bot the same way I treat service accounts? Last month, a compliance manager wanted to know if AI agents count tow
IncidentBetween January and December 2025, the CVE Program disclosed 48,174 new vulnerabilities. That s 131 per day. Your team can t patch 131 things daily. Nobody can. The real problem isn t the volume. It s
GeneralScope This guide addresses the security implications of AI-assisted development tools like GitHub Copilot, Amazon CodeWhisperer, and Cursor on your application security program. It covers changes in t
IncidentA vulnerability researcher discovered that Salesforce and ServiceNow portals remained exposed for 17 months before detection. During that time, attackers exploited a Metabase zero-day to access custom
IncidentYour vendor management program looked solid on paper. You had a questionnaire, reviewed SOC 2 reports annually, and checked the compliance boxes. Then a third-party incident hit, and you re facing a $
IncidentWhat Happened During DARPA s Artificial Intelligence Cyber Challenge (AIxCC), Team Atlanta deployed OSS-CRS, an AI-driven system designed to automatically detect and patch vulnerabilities in open sour
GuidesThe question at hand Your organization relies on thousands of API keys, service accounts, OAuth tokens, and machine credentials. Every CI/CD pipeline, microservice, and monitoring agent needs credenti
