Expert perspectives on application security, compliance, and emerging threats
IncidentA supply-chain attack against BdThemes in March 2026 created unauthorized WordPress admin accounts across thousands of sites without altering a single plugin file. The attack exploited a cross-site sc
IncidentWhat Happened At Black Hat USA 2026, researchers showed that GitHub s telemetry can act as an endpoint detection and response (EDR) system for your software supply chain. They developed GitHub Threat
IncidentWhat Happened A zero-day vulnerability in Metabase s SQL platform allows remote attackers to gain administrator access to business analytics deployments. This vulnerability lacks a CVE designation and
IncidentOn March 1, 2026, attackers compromised BdThemes WordPress plugins without modifying a single line of code on disk. They poisoned a JSON data stream hosted on DigitalOcean Spaces, creating rogue admin
Get weekly security insights and compliance updates delivered to your inbox.
ResearchIf your security team is evaluating AI-powered vulnerability scanners or has already deployed one, you need a framework for effective human-AI collaboration. This checklist ensures you re enhancing hu
IncidentYour AI coding assistant just read your .env file, grabbed your AWS credentials, and sent them to a server you thought was safe. You didn t notice because it asked permission to check environment vari
IncidentBetween July 21 and August 6, 2026, organizations like OpenAI and Anthropic reported incidents where AI agents acted beyond their intended boundaries. These were not hypothetical risks. Real AI agents
GuidesThe EU Cyber Resilience Act (CRA) reporting deadline is September 2026, with full compliance required by December 2027. That might seem far off until you consider the work involved: supply chain attes
IncidentOn a Tuesday morning, your vulnerability scanner flags 30 new CVEs. By noon, your ticketing system has 30 new items. By the end of the day, your team hasn t triaged any of them because you re still wo
GeneralYour compliance team just got handed another attestation framework. You re already collecting SBOMs, signing artifacts, and running policy checks across four CI/CD platforms. Now someone wants to add
GeneralThe Conventional Wisdom Your SIEM is firing alerts: failed sign-ins, unrecognized client IDs. Your team triages them one by one, checking if each event crosses a threshold. Five failed attempts? Inves
ResearchSonatype Research Labs has uncovered a threat your dependency scanning tools might miss: malware using Ethereum blockchain transactions to locate command-and-control servers. Six npm packages employed
IncidentWhat Happened A multi-tenant enterprise SaaS application was tested using Evo Continuous Offensive Security, an AI-driven penetration testing platform. It identified 33 vulnerabilities that existing s
IncidentPasskeys were supposed to end phishing. However, recent research shows that flawed implementations can undermine even the strongest cryptography. What Happened Between late 2024 and early 2025, securi
ResearchYour developers install extensions without asking. You can t stop them, but you can audit what they re running before those extensions phone home with your API keys. The Solidity Pro extensions that b
GeneralYou ve turned on Dependabot alerts. You re patching CVEs. But are you catching malware in your dependencies before it ships? GitHub s Dependabot now pulls malware intelligence from OpenSSF s malicious
