Expert perspectives on application security, compliance, and emerging threats
ResearchIf your team installs packages from public registries, you need a systematic way to catch trojanized dependencies before they reach production. The recent RedC2 4.0 campaign, where attackers published
ResearchYour team is evaluating AI coding agents. The vendor shows you impressive benchmark scores on SWE-Bench. You re ready to sign. But those benchmarks don t test what you actually need: the ability to re
ResearchThe Challenge On August 15, 2026, OpenSourceMalware discovered 16 malicious packages in the RubyGems repository, all designed to steal browser credentials and cryptocurrency wallets. The attackers did
ResearchYour AI coding assistant increased pull requests by 40% last month, leaving your senior engineers overwhelmed with review queues. According to the 2025 DORA data, key delivery metrics like lead time,
Get weekly security insights and compliance updates delivered to your inbox.
ResearchA research team decoded 315,320 thinking blocks from 6,708 public agent trajectories and recovered 704 distinct privacy artifacts, including 62 API keys and 33 passwords, from OpenAI, Anthropic, and G
ResearchIf your security team is evaluating AI-powered vulnerability scanners or has already deployed one, you need a framework for effective human-AI collaboration. This checklist ensures you re enhancing hu
ResearchSonatype Research Labs has uncovered a threat your dependency scanning tools might miss: malware using Ethereum blockchain transactions to locate command-and-control servers. Six npm packages employed
ResearchYour developers install extensions without asking. You can t stop them, but you can audit what they re running before those extensions phone home with your API keys. The Solidity Pro extensions that b
ResearchWhen Manifold Security pulled 77 malicious extensions from Open VSX between July 26 and August 1, 2026, many security teams thought, We don t use Open VSX, so this doesn t affect us. This mindset allo
ResearchThe Question at Hand Your dependency scanner flagged 47 suspicious packages last month. By the time it caught them, developers had already run npm install, pulled in transitive dependencies, and possi
ResearchA researcher showed command-and-control influence over ChatGPT s isolated sandbox at Black Hat USA 2026. If you re running AI tools in production, you must decide: treat AI systems like any other thir
ResearchWhen North Korean hackers started encoding command-and-control (C2) IPs in Ethereum transaction recipient addresses, they exposed a gap most security teams didn t know they had. The NullReceiver techn
ResearchA malicious GitHub issue shouldn t be able to trigger privileged workflows in your repository. But that s exactly what happened when Pillar Security discovered a vulnerability in Google s ADK Python r
ResearchYour CI/CD pipeline might be generating passwords right now. If you re using AI coding assistants, there s a good chance those passwords are predictable and undetectable by your secret scanners. Resea
ResearchScope This guide covers how to identify and prioritize security-relevant code changes that ship without CVE assignments or security advisories. You ll learn to build a process that catches exploitable
ResearchPurpose of the Template Your Third-Party Notices (TPNs) likely sit in a compliance folder as a lengthy PDF with inconsistent formatting. While they re generated for legal reasons, they don t contribut
