Expert perspectives on application security, compliance, and emerging threats
ResearchYour AI coding assistant increased pull requests by 40% last month, leaving your senior engineers overwhelmed with review queues. According to the 2025 DORA data, key delivery metrics like lead time,
ResearchA research team decoded 315,320 thinking blocks from 6,708 public agent trajectories and recovered 704 distinct privacy artifacts, including 62 API keys and 33 passwords, from OpenAI, Anthropic, and G
ResearchIf your security team is evaluating AI-powered vulnerability scanners or has already deployed one, you need a framework for effective human-AI collaboration. This checklist ensures you re enhancing hu
ResearchSonatype Research Labs has uncovered a threat your dependency scanning tools might miss: malware using Ethereum blockchain transactions to locate command-and-control servers. Six npm packages employed
Get weekly security insights and compliance updates delivered to your inbox.
ResearchYour developers install extensions without asking. You can t stop them, but you can audit what they re running before those extensions phone home with your API keys. The Solidity Pro extensions that b
ResearchWhen Manifold Security pulled 77 malicious extensions from Open VSX between July 26 and August 1, 2026, many security teams thought, We don t use Open VSX, so this doesn t affect us. This mindset allo
ResearchThe Question at Hand Your dependency scanner flagged 47 suspicious packages last month. By the time it caught them, developers had already run npm install, pulled in transitive dependencies, and possi
ResearchA researcher showed command-and-control influence over ChatGPT s isolated sandbox at Black Hat USA 2026. If you re running AI tools in production, you must decide: treat AI systems like any other thir
ResearchWhen North Korean hackers started encoding command-and-control (C2) IPs in Ethereum transaction recipient addresses, they exposed a gap most security teams didn t know they had. The NullReceiver techn
ResearchA malicious GitHub issue shouldn t be able to trigger privileged workflows in your repository. But that s exactly what happened when Pillar Security discovered a vulnerability in Google s ADK Python r
ResearchYour CI/CD pipeline might be generating passwords right now. If you re using AI coding assistants, there s a good chance those passwords are predictable and undetectable by your secret scanners. Resea
ResearchScope This guide covers how to identify and prioritize security-relevant code changes that ship without CVE assignments or security advisories. You ll learn to build a process that catches exploitable
ResearchPurpose of the Template Your Third-Party Notices (TPNs) likely sit in a compliance folder as a lengthy PDF with inconsistent formatting. While they re generated for legal reasons, they don t contribut
ResearchLast week, security researchers found that an attacker published malicious npm packages to the official @asyncapi namespace without stealing any credentials. They hijacked the project s GitHub Actions
ResearchRethinking Vulnerability Disclosure Many security teams treat vulnerability disclosure as a mere compliance task. You might post a security.txt file, set up a [email protected] email that routes to
ResearchYour team just adopted an AI coding assistant. You ve reviewed the privacy settings, turned off model training, and assumed you re protected. Meanwhile, the tool is uploading your entire Git history t
