Expert perspectives on application security, compliance, and emerging threats
IncidentOn October 13, 2026, the deadline for NIST s Request for Information (RFI) will close. If your team hasn t submitted feedback yet, you re missing a key opportunity to influence the future of vulnerabi
IncidentOn December 20, 2024, developers installing LiteLLM versions 1.82.7 or 1.82.8 from PyPI unknowingly turned their workstations into credential extraction engines. The TeamPCP threat actor had compromis
GeneralYour team just merged a PR with 3,000 lines of auto-generated API client code. Another developer shipped 5,000 lines of boilerplate from an LLM. Your review queue looks like a novel, and you re still
IncidentA vulnerability in libpng went undetected for three decades before it was patched in February 2026. Similarly, Windows PrintDemon lingered in production code for 24 years before Microsoft addressed it
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened CVE-2026-71362 allows attackers to hijack customer accounts on Adobe Commerce and Magento platforms without authentication. Adobe released patches for this vulnerability along with fixes
GeneralThe Conventional Wisdom Your security team is probably planning how to defend against AI-powered browser agents. New threat model, new controls, new budget asks. The assumption: autonomous browsers re
IncidentOn March 24, 2026, the cybercriminal group TeamPCP published two malicious versions of LiteLLM to PyPI. Within hours, organizations using these compromised packages began leaking credentials to attack
IncidentOn patch Tuesday in December 2024, SAP disclosed CVE-2026-58231, a vulnerability in SAP Commerce Cloud that scored 10.0 on CVSS. This is the highest severity rating possible. An unauthenticated attack
IncidentTracebit researchers discovered something unexpected while testing AI security tools on Amazon Web Services: they could stop automated hacking agents mid-attack by placing specific text strings next t
IncidentA vulnerability in a new package just gave attackers complete access to business intelligence data across thousands of organizations. On August 6, researchers disclosed CVE-2026-72898, a SQL Injection
IncidentOn March 24, malicious versions of LiteLLM were uploaded to PyPI for just 40 minutes. In that brief period, credential-stealing code infiltrated CI/CD pipelines at over 2,500 organizations, according
ResearchA research team decoded 315,320 thinking blocks from 6,708 public agent trajectories and recovered 704 distinct privacy artifacts, including 62 API keys and 33 passwords, from OpenAI, Anthropic, and G
IncidentAI s Breakthrough and the Human Oversight Gap James Kettle at PortSwigger Research developed an autonomous system called the HTTP Terminator to explore whether AI could independently create new attack
GeneralAI coding agents can write Go code faster than your team can review it. But new data shows these tools struggle most when they inherit code from other AI agents. What the Data Shows Research using the
GuidesYour autonomous coding agents don t read your CONTRIBUTING.md file. They don t check your pull request template. They don t follow your branch naming conventions. A study from Peking University tested
IncidentAdobe released patches for three vulnerabilities scoring 10.0 on the CVSS scale in January 2025. Two affected ColdFusion (CVE-2026-48362 and CVE-2026-71398), and one hit Campaign Classic. Within days,
