Expert perspectives on application security, compliance, and emerging threats
GeneralThe Conventional Wisdom Your team might hear that verifying AI model provenance—confirming a model s origin and training process—is essential for managing AI risk. Tools like Cisco s Model Provenance
IncidentWhat Happened On April 30, 2026, threat actors released two malicious versions of PyTorch Lightning—2.6.2 and 2.6.3—on the Python Package Index (PyPI). These packages included a hidden _runtime direct
IncidentOn a routine Thursday, developers who ran npm install on SAP s Cloud Application Programming Model packages received more than they expected. Four official SAP packages — @cap-js/sqlite v2.2.2, @cap-j
IncidentGitHub recently faced a potential crisis with CVE-2026-3854, a remote code execution vulnerability that threatened millions of private repositories. Within two hours of receiving the report, GitHub ha
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened On January 15, 2025, GitHub disclosed a remote code execution (RCE) vulnerability affecting both GitHub.com and GitHub Enterprise Server. Wiz security researchers discovered the flaw usi
IncidentWhat Happened A server-side template injection vulnerability in Thymeleaf (CVE-2026-40478) has been identified with a CVSS score of 9.1, indicating critical severity with potential for remote code exe
IncidentWhat Happened Between late February and early March 2026, attackers compromised three critical components of the AI development stack: Bitwarden CLI (a secrets management tool), Lovable (an AI code ge
IncidentIncident Overview On April 29, 2026, between 09:55 UTC and 12:14 UTC, attackers released compromised versions of several npm packages linked to SAP s JavaScript and cloud application development ecosy
GeneralThe Conventional Wisdom Your security team likely treats third-party plugins like procurement decisions. You download a component, run it through a static scanner, maybe have a senior engineer check t
GeneralScope This guide examines the operational and compliance implications of relying on public package registries like Maven Central, PyPI, npm, and RubyGems in your software delivery pipeline. If your te
IncidentWhat Happened On April 24, 2025, attackers published version 0.23.3 of the Python package elementary-data to PyPI. This malicious release contained code designed to exfiltrate cloud credentials from a
IncidentWhat Happened Attackers distributed self-propagating malware through VS Code extensions published to the Open VSX repository. These extensions appeared legitimate but contained code designed to spread
GeneralYour developers installed 14 new VS Code extensions last week. How many did your security team review? If the answer is none, you re not alone—and that s exactly what the threat actors behind GlassWor
IncidentWhat Happened On April 24, security researchers disclosed CVE-2026-42208 , a critical SQL injection vulnerability in LiteLLM, an open-source gateway for managing LLM API calls. This flaw allowed attac
IncidentWhat Happened Marquis, a fintech company serving financial institutions, suffered a ransomware attack that exposed personal information for at least 672,075 individuals. The attackers bypassed direct
IncidentWhat Happened In late 2024, security researchers at Wiz discovered CVE-2026-3854, a remote code execution vulnerability in GitHub s infrastructure. This flaw allowed attackers to execute arbitrary cod
