Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened LastPass disclosed that attackers accessed customer data in its Salesforce environment using compromised OAuth tokens from Klue, a market intelligence platform. The breach exposed standa
IncidentWhat Happened OpenAI and Trail of Bits launched Patch the Planet, an AI-assisted vulnerability research program targeting critical open-source projects. The program used AI models and Codex Security t
IncidentWhat Happened A user named abdrizak published three malicious npm packages disguised as legitimate PostCSS tools: aes-decode-runner-pro , postcss-minify-selector , and postcss-minify-selector-parser .
IncidentWhat Happened Between late 2025 and early 2026, attackers discovered they could chain two vulnerabilities in LiteLLM—an open-source AI gateway used to route requests across multiple LLM providers—to a
Get weekly security insights and compliance updates delivered to your inbox.
GeneralThe conventional wisdom suggests that AI-generated code should undergo the same review process as human-written code. This involves running it through your existing CI/CD pipeline, having a senior dev
IncidentWhat Happened ShapedPlugin, a vendor of premium WordPress plugins, experienced a supply chain attack that injected backdoor code into official releases of multiple Pro plugins. This affected Product S
IncidentWhat Happened On June 18, 2024, GitHub announced a security update to actions/checkout v7 to prevent workflows from executing unreviewed code from forked pull requests. This change addresses a recent
IncidentA vulnerability chain in Microsoft s AutoGen Studio allowed attackers to execute arbitrary code through malicious webpages. This flaw affected developers who built the framework from GitHub source dur
GeneralSecurity scanners gave it a clean bill of health. GitHub stars suggested community trust. The skill looked legitimate by every conventional measure. Then it changed—after installation—and roughly 26,0
IncidentOn June 18, 2026, GitHub updated actions/checkout to prevent fetching fork pull request code when triggered by pull_request_target or workflow_run events. This change addresses an attack pattern where
IncidentOn December 11, 2019, security researcher Daniel Ruf disclosed a vulnerability that allowed any malicious npm package to overwrite arbitrary files on your system during installation. No exploit code w
IncidentYour organization has just deployed its first AI agent into production. It authenticates through your existing identity provider (IdP), accesses your cloud storage, and queries your databases — the sa
ResearchAfter Zafran Security published their DifyTap research, compliance teams began questioning tenant isolation in multi-tenant AI platforms. This issue is not limited to Dify, which boasts over 146,000 G
ResearchYour team wants to integrate AI agents into your development workflow. You find a plugin registry with hundreds of options. Some have official-looking scope names. Some claim to be maintained by the r
IncidentWhat Happened On February 6, 2020, the Node.js project released emergency patches for versions 10.x, 12.x, and 13.x to address one critical and two high-severity vulnerabilities. The critical flaw, tr
IncidentA developer at a Fortune 100 technology company opened their AI coding assistant one morning. Within minutes, an attacker was executing code on their machine—no credential theft, no malware download,
