Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened On December 17, 2024, PyPI implemented a rule blocking new file uploads to package releases older than 14 days. GitHub followed with a default three-day cooldown period in Dependabot bef
IncidentAn attacker compromised Claude Code s memory system. No credentials were stolen. No malware was deployed. Instead, the attack poisoned the AI s stored context, the preferences, workflows, and learned
IncidentMalicious versions of legitimate npm packages recently went live on the registry, but they were caught and removed within two hours. This incident led GitHub to introduce a three-day delay for Dependa
IncidentOn January 14, 2025, Anthropic published research on Mythos Preview, an AI system that autonomously completed a 32-step corporate network attack simulation. This wasn t about a real breach, but it rev
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Anthropic launched Glasswing, a $100 million initiative to use AI for identifying vulnerabilities at scale. They soon released Claude Mythos, an AI system designed to autonomously discov
IncidentWhat Happened In 2025, GitHub s public repositories exposed 28,649,024 new secrets, a 34% increase from the previous year. The root cause wasn t a single breach. It was systemic: AI-assisted developme
IncidentYour Spring Boot application uses Fastjson 1.x for JSON parsing. Threat actors are exploiting CVE-2026-16723 in the wild. The CVSS score is 9.0. As of July 25, Alibaba hasn t released a patched versio
IncidentIn early 2024, researchers monitoring cybercrime forums documented a seven-month conversation among threat actors exploring AI tools. The analysis covered more than 160 forum threads where criminals d
IncidentThe Problem Organizations are deploying LLM servers with default configurations, missing authentication, and public network exposure. Attackers are actively scanning for exposed AI infrastructure and
IncidentIntroduction Google has launched CodeMender, an AI-powered security tool that autonomously identifies, confirms, and patches code vulnerabilities without waiting for manual intervention. This tool, su
IncidentYour AI coding assistant just suggested a Python package to solve your authentication problem. The name sounds plausible. You install it. Your build passes. Three weeks later, you discover it s malwar
IncidentYour AI coding assistant just installed a package that doesn t exist. Or rather, it didn t exist until an attacker predicted it would hallucinate that exact name and registered it first. This isn t th
IncidentOn a Tuesday afternoon, Aikido Security deployed their AI pentest agents on NodeBB, a federated forum platform. Six hours later, they identified eight high-severity vulnerabilities, including direct a
IncidentOn July 13, 2026, ServiceNow released patches for CVE-2026-6875, a critical vulnerability in its AI Platform that allows unauthenticated remote code execution. Five days later, researchers observed ac
IncidentWhat Happened On July 8, 2026, the Python Package Index (PyPI) implemented a significant change. You can no longer upload new files to a release that s more than 14 days old. If you need to add a Pyth
IncidentWhat Happened Anthropic s Mythos Preview announcement marked a turning point in how your security team should approach threat mitigation. It wasn t about a breach or vulnerability disclosure. Instead,
