Expert perspectives on application security, compliance, and emerging threats
IncidentA Major Shift in Security Priorities On September 24, 2021, OWASP released an updated Top 10 list that significantly altered the landscape of security priorities. SQL injection, which had long been a
IncidentWhat Happened In 2020, researcher Yeting Li discovered a Regular Expression Denial of Service (REDoS) vulnerability in UAParser.js, a widely-used JavaScript library for parsing user agent strings. The
IncidentA malicious web page executing arbitrary code on your development machine through your AI agent—that s exactly what Microsoft researchers discovered in AutoGen Studio s pre-release builds. The AutoJac
IncidentWhat Happened CVE-2026-4020 , a vulnerability in the Gravity SMTP WordPress plugin, allows unauthenticated attackers to extract API keys and SMTP configuration data through a broken access control fla
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn January 9, 2025, attackers compromised the npm account of a Mastra AI maintainer and published malicious updates to over 140 packages. Microsoft attributes the attack to Sapphire Sleet, a North Kor
IncidentF5 disclosed two critical remote code execution vulnerabilities in NGINX Open Source on January 14, 2025. Both CVE-2026-42530 and CVE-2026-42055 carry CVSS v4 scores of 9.2. If your team is running NG
IncidentWhat Happened Researchers at Hong Kong University of Science and Technology have discovered a denial-of-service attack that exploits AI agent safety systems. This attack, known as reasoning-extension
IncidentYour security information and event management (SIEM) platform should detect intrusions, not enable them. However, in June 2026, organizations running unpatched Splunk Enterprise found themselves in a
IncidentWhat Happened Varonis Threat Labs revealed a prompt injection attack against Microsoft M365 Copilot Enterprise that exposed internal corporate data through manipulated URL parameters. The attack, call
IncidentA vulnerability fix in a widely-used Golang JWT package was never merged into the version most developers used. This oversight left projects exposed to authentication bypass, despite the existence of
IncidentWhat Happened Novo Nordisk experienced a security breach when an attacker accessed its systems through a leaked GitHub token. This token, a credential for automated systems to interact with the compan
IncidentWhat Happened Your developers store credentials on their laptops. Git history, environment files, configuration snippets, and API keys are all vulnerable on machines that connect to public WiFi, run u
IncidentWhat Happened F5 released emergency security patches for critical vulnerabilities in NGINX web server modules. Two vulnerabilities—CVE-2026-42530 and CVE-2026-42055—allow unauthenticated remote attack
IncidentWhat Happened ShapedPlugin s distribution system was compromised, allowing attackers to inject malware into three premium WordPress plugins via the official update mechanism. The backdoor impersonated
IncidentOn June 17, 2026, Sonatype researchers identified a supply chain attack targeting the Mastra AI framework. The attacker published a malicious npm package named easy-day-js , designed to mimic the popu
IncidentWhat Happened A mid-sized SaaS company discovered a critical remote code execution (RCE) vulnerability in their customer-facing API on day 14 of its exposure. The vulnerability came from an outdated d
