Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams683 Security Engineers451 Compliance Teams155 DevOps Leaders38 Developers28 CISOs8 IT Directors2

Topics:All683 Incident440 General91 Standards82 Research31 Guides25 Deadlines7 Vendor News4 Legal2

683 articlesSort byNewest·Trending

AI Code Models Trained on Swept Data Cut Vulnerabilities by 41%

General

Latest

3 min read

AI Code Models Trained on Swept Data Cut Vulnerabilities by 41%

The focus on AI-assisted coding often centers on model architecture and performance metrics. However, new data from Sonar s SonarSweep experiments highlights a critical factor: the quality of training

For Security EngineersRead article

Log4Shell: How a Logging Library Became CVE-2021-44228

Incident

4 min read

Log4Shell: How a Logging Library Became CVE-2021-44228

What Happened In December 2021, a critical vulnerability in Apache Log4j—a widely used Java logging library—allowed attackers to execute arbitrary code on vulnerable systems. This exploit, known as CV

For Compliance TeamsRead

Loop-Driven AI Development: A Verification Field Guide

General

5 min read

Loop-Driven AI Development: A Verification Field Guide

In AI-driven development, verifying that your agents build correctly is as important as what they build. The shift from prompt-driven to loop-driven development fundamentally changes your verification

For Security EngineersRead

AI Agents Won't Fix Your Spring Upgrades

General

5 min read

AI Agents Won't Fix Your Spring Upgrades

You ve probably heard the pitch: point an AI coding agent at your legacy Spring Boot 2.7 codebase, and watch it handle the upgrade to Spring Boot 3 or 4. No more manual refactoring. No more dependency

For DevOps LeadersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

AI Agent Runs Malicious Code from Error Logs

Incident

5 min read

AI Agent Runs Malicious Code from Error Logs

What Happened Tenet Security discovered a new attack pattern called Agentjacking that weaponizes AI coding agents against their own development teams. The attack works by injecting malicious code into

For Security EngineersRead

When the AI Agent You Built Stops Working

Incident

4 min read

When the AI Agent You Built Stops Working

You developed an AI security agent in just three days. It scanned your repositories, flagged secrets, and impressed your VP. Two months later, it s generating 400 false positives per day, and your tea

For Security EngineersRead

phpBB's Ten-Year Auth Bypass: A Teardown

Incident

4 min read

phpBB's Ten-Year Auth Bypass: A Teardown

An authentication bypass vulnerability lingered in phpBB s codebase for a decade, allowing admin access through a specially crafted request. Aikido discovered the flaw on June 2nd, and phpBB released

For Security EngineersRead

Log4Shell: When a Logging Library Became an RCE Vector

Incident

5 min read

Log4Shell: When a Logging Library Became an RCE Vector

What Happened On December 9, 2021, security researchers disclosed CVE-2021-44228 , a critical remote code execution vulnerability in Log4j2, a widely used Java logging framework maintained by the Apac

For Security EngineersRead

3,000 Stolen GitHub Tokens Found on Dark Forums

Incident

4 min read

3,000 Stolen GitHub Tokens Found on Dark Forums

What Happened Flare researchers discovered active listings for compromised developer credentials and access tokens on underground forums—weeks before these same credentials appeared in public supply-c

For Security EngineersRead

Argo CD Zero-Day: When CD Platforms Become the Attack Vector

Incident

4 min read

Argo CD Zero-Day: When CD Platforms Become the Attack Vector

What Happened On January 18, 2022, security researchers disclosed CVE-2022-24348 , a directory/path traversal vulnerability in Argo CD, a continuous delivery platform used to automate Kubernetes deplo

For DevOps LeadersRead

Your AI Debugger Is Fighting Yesterday's War

General

5 min read

Your AI Debugger Is Fighting Yesterday's War

The Conventional Wisdom When your AI integration starts producing incorrect outputs, your team often relies on familiar tools: stack traces, breakpoints, and unit tests. You might add logging around t

For Security EngineersRead

Incident

5 min read

AI Agent Hijacked on Live Demo Platform

What Happened A security evaluation using the StakeBench benchmark revealed that current AI web agents are vulnerable to prompt injection attacks across various deployment scenarios. Researchers teste

For Security EngineersRead

400 AUR Packages Hijacked Through Maintainer Abandonment

Incident

5 min read

400 AUR Packages Hijacked Through Maintainer Abandonment

What Happened On or after June 11, an attacker compromised over 400 packages in the Arch User Repository (AUR) by exploiting a fundamental weakness in community-maintained package systems: abandonment

For Security EngineersRead

LangGraph RCE: SQL Injection in an AI Framework

Incident

4 min read

LangGraph RCE: SQL Injection in an AI Framework

What Happened In January 2025, Check Point researcher Yarden Porat disclosed three vulnerabilities in LangGraph, a framework for building stateful AI agent workflows. The most severe, CVE-2025-67644 (

For Security EngineersRead

Incident

3 min read

When Malware Became a Subscription Service

What Happened Between late 2023 and early 2024, three incidents highlighted a shift from opportunistic cyber attacks to professional service operations. SafeDep documented the Miasma supply chain atta

For Security EngineersRead

Static Analysis Caught This RCE Before Attackers Did

Incident

3 min read

Static Analysis Caught This RCE Before Attackers Did

What Happened A remote code execution vulnerability was discovered in Celery , a widely-used Python distributed task queue. This flaw allowed attackers to execute arbitrary commands through object tra

For Security EngineersRead

Showing 17-32 of 683 articles

PreviousPage 2 of 43Next