Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened Novo Nordisk experienced a security breach when an attacker accessed its systems through a leaked GitHub token. This token, a credential for automated systems to interact with the compan
IncidentWhat Happened Your developers store credentials on their laptops. Git history, environment files, configuration snippets, and API keys are all vulnerable on machines that connect to public WiFi, run u
GeneralScope This guide focuses on governance frameworks for AI-assisted code generation in organizations where employees use tools like Claude Code, GitHub Copilot, or ChatGPT to create applications outside
ResearchYou ve sat through the vendor demo. The slide deck claims 99% accuracy in bold letters. The sales engineer points to benchmark results showing their tool catches more vulnerabilities than competitors.
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened F5 released emergency security patches for critical vulnerabilities in NGINX web server modules. Two vulnerabilities—CVE-2026-42530 and CVE-2026-42055—allow unauthenticated remote attack
IncidentWhat Happened ShapedPlugin s distribution system was compromised, allowing attackers to inject malware into three premium WordPress plugins via the official update mechanism. The backdoor impersonated
IncidentOn June 17, 2026, Sonatype researchers identified a supply chain attack targeting the Mastra AI framework. The attacker published a malicious npm package named easy-day-js , designed to mimic the popu
IncidentWhat Happened A mid-sized SaaS company discovered a critical remote code execution (RCE) vulnerability in their customer-facing API on day 14 of its exposure. The vulnerability came from an outdated d
IncidentThe Breach: A Summary In early 2020, attackers infiltrated SolarWinds build environment, embedding malicious code into the Orion platform update process. When SolarWinds released the compromised updat
StandardsThese questions come from compliance teams I ve talked to over the past six months. The new PCI DSS v4.0.1 requirements around payment-page scripts caught many organizations off guard. Requirement 6.4
IncidentWhat Happened A Java application using snakeyaml before version 1.26 processed a malicious YAML file, triggering a Denial of Service vulnerability. The attack exploited YAML s entity expansion feature
IncidentA vulnerability in the Google Cloud Vertex AI SDK allowed attackers to replace legitimate machine learning models with malicious ones—without needing credentials. Discovered by Palo Alto Networks Unit
IncidentWhat Happened Google s Vertex AI SDK for Python versions 1.139.0 and 1.140.0 had a design flaw allowing attackers to execute arbitrary code. The issue arose from predictable cloud storage bucket namin
IncidentWhat Happened In 2019, a former AWS employee exploited a server-side request forgery (SSRF) vulnerability in Capital One s web application firewall configuration to access the EC2 instance metadata se
IncidentOn June 17, 2026, an attacker accessed a dormant npm account belonging to a former Mastra contributor. Within hours, they republished every package in the @mastra scope with a malicious dependency tha
IncidentImmediate Action Required for Federal Agencies The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-48907 to its Known Exploited Vulnerabilities Catalog, mandating federal ag
