Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened On August 28, JFrog disclosed CVE-2026-82329, a critical authentication bypass vulnerability in Artifactory with a CVSS score of 9.8. This flaw allows attackers to gain administrative pr
IncidentOn July 8, 2026, the Open Source Geospatial Foundation (OSGeo) released GeoNetwork versions 4.4.12 and 4.2.17 to fix two vulnerabilities that, when combined, allow unauthenticated remote code executio
IncidentOn the morning after JFrog disclosed CVE-2026-82329, attackers were already scanning for vulnerable Artifactory instances. This authentication bypass flaw lets anyone gain admin-level access to your r
IncidentThe Challenge AI-powered tools have drastically sped up vulnerability discovery, reducing a 60-day research process to just four hours. Major vendors now use models from Anthropic and OpenAI to identi
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhen you clone a repository, you expect your AI coding assistant to help write code. You don t expect it to execute an attacker s commands without asking. That s exactly what happened with eight vulne
IncidentWhat Happened DryRun Security tested three AI coding agents, OpenAI Codex GPT 5.2, GitHub Copilot Workspace, and Replit Agent, on two application builds. The agents generated code for a task managemen
IncidentWhat Happened On August 28, 2026, JFrog released Artifactory version 7.161.20 to patch CVE-2026-82329 , an authentication bypass vulnerability with a CVSS score of 9.8. Just four days later, on Septem
IncidentCursor s security review system identifies over 200 vulnerabilities weekly across 3,000+ internal pull requests. This isn t a security incident; it s a testament to effective automation. It highlights
IncidentIntroduction In 2026, Frost Sullivan recognized Picus Security as the Innovation Index Leader in their Frost Radar report on Automated Security Validation. This accolade wasn t for minor tweaks to exi
IncidentA vulnerability in Ruby on Rails libvips image processing library (CVE-2026-66066) has been actively exploited since early March 2024. VulnCheck recorded more than 360 exploitation attempts within the
IncidentWhat Happened A development team using LLM-assisted code generation released multiple pull requests containing hardcoded API keys, database credentials, and overly permissive access controls. The code
IncidentWhat Happened Researchers found that AI coding agents can follow hidden instructions in project README files, even if those instructions lead to data leaks. In tests using ReadSecBench, a specialized
IncidentIncident Overview An AI-powered customer service system fell victim to a malicious prompt that extracted internal knowledge base content and exposed it to an unauthorized user. The attack succeeded be
IncidentWhat Happened Internet-wide scanning has revealed 175,000 Ollama servers with publicly accessible APIs. Ollama, a tool for running large language models locally or on cloud infrastructure, exposes a R
IncidentA supply chain attack compromised 19 Chrome and Edge extensions between December 2024 and January 2025. Attackers acquired legitimate extensions, pushed malicious updates through official channels, an
IncidentOn January 16, 2025, security researchers disclosed a vulnerability in the GiveWP WordPress plugin that earned a perfect 10.0 CVSS score. CVE-2026-82222 joins four other critical flaws affecting widel
