Expert perspectives on application security, compliance, and emerging threats
IncidentOn January 13, 2025, Metabase disclosed a zero-day vulnerability that allowed unauthenticated attackers to gain full administrative access to self-hosted instances. This flaw, with a CVSS score of 10.
ResearchA researcher showed command-and-control influence over ChatGPT s isolated sandbox at Black Hat USA 2026. If you re running AI tools in production, you must decide: treat AI systems like any other thir
IncidentVulnerability Overview AI browsers from leading vendors are vulnerable to prompt injection attacks, despite multiple security measures. These attacks let malicious actors manipulate AI browsing featur
IncidentOn February 11, 2025, CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog. Within 48 hours, security researchers recorded 650 exploitation attempts from 244 unique IP addresses tar
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Between October and December 2024, attackers used stolen npm credentials to publish malicious versions of over 400 packages. These releases contained a variant of the Mini Shai-Hulud cre
IncidentBetween July 11 and August 2, someone uploaded trojanized AI agent skills to the skills.sh marketplace. By the time Zenity s research team flagged them, these malicious skills had been downloaded over
IncidentSecurity researchers at Oligo Security have uncovered a threat actor, TeamPCP, that has been active since 2020. Initially targeting infrastructure like Redis, Docker, and Kubernetes, they ve now shift
IncidentA malicious agent configuration file shouldn t give an attacker root access to your control plane. But in Paperclip s case, it did exactly that. What Happened Oasis Security disclosed two critical vul
IncidentAn attacker can take over your WordPress site without knowing a single password. That s the reality of CVE-2026-64638, a pre-authentication cross-site scripting vulnerability affecting all WordPress v
IncidentOn March 24, 2026, two malicious versions of LiteLLM, 1.82.7 and 1.82.8, appeared on PyPI. This package, which routes API calls across multiple LLM providers, was compromised by TeamPCP, a group targe
IncidentWhat Happened On July 17, 2026, IBM disclosed CVE-2026-9198 , a critical remote code execution vulnerability in Langflow, its open-source AI workflow automation platform. This flaw allows attackers to
IncidentWhat Happened PortSwigger s HTTP Terminator, an AI-assisted vulnerability research system, identified a zero-day vulnerability in Apache Traffic Server while testing HTTP desynchronization techniques.
IncidentOn August 5, Novee Security demonstrated at Black Hat USA how two widely used AI coding assistants could leak CI/CD secrets through a simple attack: a crafted GitHub issue. Both Anthropic s Claude Cod
GeneralYour team is probably using AI coding assistants like GitHub Copilot or Amazon CodeWhisperer. These tools promise to speed up development and automatically fix bugs. The pitch is compelling: let AI ha
IncidentOn August 4, 2026, the Shai-Hulud malware campaign struck npm, infecting packages in the keyv and cacheable ecosystems. By the time Sonatype s research team flagged it, 2,225 component versions were c
IncidentA critical vulnerability in JetBrains TeamCity (CVE-2026-63077) is being actively exploited. CISA added it to the Known Exploited Vulnerabilities catalog and issued Binding Operational Directive (BOD)
