Expert perspectives on application security, compliance, and emerging threats
IncidentOn July 10, 2025, security researcher Antoni Tremblay reported a vulnerability to JetBrains through their coordinated disclosure program. The flaw, tracked as CVE-2026-63077, allows unauthenticated re
GuidesThe Question at Hand Your security team is evaluating AI agents for threat detection, incident response, or vulnerability analysis. The vendor pitch sounds promising, but here s what they won t tell y
GeneralCISA just released updates to its SBOM guidance. Your compliance team is probably updating templates right now. But here s the question: will any of this actually reduce your supply chain risk? The ho
IncidentImproved Security in AI Models Anthropic has released data showing that Opus 5 significantly improves resistance to prompt injection attacks. On the IPI benchmark, Opus 5 reduced the probability of a
Get weekly security insights and compliance updates delivered to your inbox.
DeadlinesYour open source dependencies won t document themselves. Yet many engineering teams treat the EU Cyber Resilience Act like it s someone else s problem until their first audit request arrives. The CRA
IncidentWhat Happened On July 27, security researcher Kevin Beaumont discovered that Adform s JavaScript tracking script had been compromised to steal cryptocurrency. The malicious code monitored users clipbo
IncidentWhat Happened In November 2025, security firm Wiz discovered a critical vulnerability in Azure Cosmos DB. This flaw could have allowed attackers to access the master key for any Cosmos DB instance. Th
GeneralWhat Changed On July 29, a coordinated attack compromised Arch User Repository (AUR) packages through the orphan adoption system. It began with openconnect-sso and expanded to over 200 packages before
IncidentWhat Happened On July 27, JetBrains disclosed CVE-2026-63077, a critical authentication bypass vulnerability in TeamCity On-Premises that allows remote code execution. This flaw affects all versions o
IncidentAn attacker sends a single HTTP request to your AI orchestration platform. Within seconds, they have shell access to your production environment, can read your database, and manipulate the memory of e
GeneralYou download millions of packages from npm, PyPI, or Packagist each year. Your CI/CD pipeline queries these registries thousands of times per day. Your entire deployment process assumes they ll respon
GuidesCISA has released the Open Source Software: Security Principles and Practices guide for federal agencies, but it s a valuable resource for any organization managing open source software (OSS). This gu
IncidentWhat Happened On October 21, 2024, attackers compromised two of npm s most widely used packages: debug (with over 200 million monthly downloads) and chalk (with over 100 million monthly downloads). Th
IncidentWhat happened Oracle s July 2026 Critical Patch Update (CPU) includes 1,449 security fixes across 1,235 unique CVEs. Nine vulnerabilities in Oracle Fusion Middleware have a CVSS score of 10.0, allowin
GeneralOnly two out of hundreds of platform engineers feel confident in their security systems for AI-written code. This statistic from PlatformCon London highlights a critical issue: your team is deploying
IncidentAn AI-powered fraud detection system at a financial services organization became the entry point for a supply chain attack. Attackers exploited trust relationships between the system s components, exp
