Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened The PCI Security Standards Council issued emergency guidance after finding that organizations were using AI systems to process cardholder data without human oversight. While no specific
IncidentWhat Happened A vulnerability in AWS Bedrock AgentCore allowed attackers to escalate from a single compromised AI chatbot to full control of an organization s AWS environment. The flaw, discovered by
IncidentBetween August 2023 and now, eight malicious npm packages accumulated 40,767 downloads, delivering Overlord RAT and information stealers to developer workstations. One package, function-flag , account
IncidentOn October 4, 2024, Patchstack identified active exploitation of two stored cross-site scripting (XSS) vulnerabilities in WordPress plugins. Attackers targeted CVE-2026-93836 in WPC Product Bundles an
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Between July 13 and early August 2026, attackers began scanning for CVE-2026-61500 , a critical remote code execution vulnerability in Rejetto HFS (HTTP File Server) versions 3.0.0 throu
IncidentWhat Happened On January 14, 2025, GitLab disclosed CVE-2026-90970 , a critical remote code execution vulnerability in its AI Gateway service. An attacker with basic user privileges could execute arbi
IncidentWhat Happened A mid-sized software vendor selling IoT devices in the EU market discovered an actively exploited vulnerability in their product line. Their security team followed their standard process
IncidentA command execution vulnerability in GitLab s AI Gateway, disclosed on October 2, 2026, scored 9.9 on the CVSS scale. If you re running a self-hosted instance with Duo Agent Platform access enabled, a
IncidentTruffle Security recently identified 543,699 unique credentials in public GitHub repositories. These aren t outdated keys. They re live credentials granting access to production systems right now. Thi
IncidentWhat Happened Truffle Security s research revealed that over 543,000 valid credentials were exposed in public GitHub repositories as of July 2024. These weren t just outdated tokens from abandoned pro
IncidentOpenAI has identified a new attack vector in simulated environments: prompt injections that can spread across AI systems. Using their GPT-Red-style training framework, researchers observed malicious p
IncidentWhat Happened Attackers exploited two zero-day vulnerabilities in Citrix NetScaler products to plant webshells on internet-facing devices. CVE-2026-88771 , the more severe of the two, allows remote, u
IncidentWhat Happened ShinyHunters, identified as UNC6240, exploited CVE-2026-35273 in Oracle PeopleSoft to deploy web shells and achieve remote code execution across multiple organizations worldwide. This vu
IncidentOn September 4, 2025, security researcher Oren Yomtov reported a vulnerability through HackerOne that allowed one Cloudflare customer to read another customer s data. The flaw was in Cloudflare s Cont
IncidentWhat Happened On September 22, WordPress released version 7.1.2 to patch CVE-2026-87902 , a critical remote code execution vulnerability discovered by security researcher Robert Ressel. This flaw affe
IncidentWhat Happened On September 22, 2026, WordPress released patches for CVE-2026-87902 , a remote code execution vulnerability with a CVSS score of 9.2. At 11:49 a.m. UTC that same day, Previdian s teleme
