Expert perspectives on application security, compliance, and emerging threats
GeneralIn AI-driven development, verifying that your agents build correctly is as important as what they build. The shift from prompt-driven to loop-driven development fundamentally changes your verification
GeneralYou ve probably heard the pitch: point an AI coding agent at your legacy Spring Boot 2.7 codebase, and watch it handle the upgrade to Spring Boot 3 or 4. No more manual refactoring. No more dependency
IncidentWhat Happened Tenet Security discovered a new attack pattern called Agentjacking that weaponizes AI coding agents against their own development teams. The attack works by injecting malicious code into
IncidentYou developed an AI security agent in just three days. It scanned your repositories, flagged secrets, and impressed your VP. Two months later, it s generating 400 false positives per day, and your tea
Get weekly security insights and compliance updates delivered to your inbox.
IncidentAn authentication bypass vulnerability lingered in phpBB s codebase for a decade, allowing admin access through a specially crafted request. Aikido discovered the flaw on June 2nd, and phpBB released
IncidentWhat Happened On December 9, 2021, security researchers disclosed CVE-2021-44228 , a critical remote code execution vulnerability in Log4j2, a widely used Java logging framework maintained by the Apac
IncidentWhat Happened Flare researchers discovered active listings for compromised developer credentials and access tokens on underground forums—weeks before these same credentials appeared in public supply-c
IncidentWhat Happened On January 18, 2022, security researchers disclosed CVE-2022-24348 , a directory/path traversal vulnerability in Argo CD, a continuous delivery platform used to automate Kubernetes deplo
GeneralThe Conventional Wisdom When your AI integration starts producing incorrect outputs, your team often relies on familiar tools: stack traces, breakpoints, and unit tests. You might add logging around t
IncidentWhat Happened A security evaluation using the StakeBench benchmark revealed that current AI web agents are vulnerable to prompt injection attacks across various deployment scenarios. Researchers teste
IncidentWhat Happened On or after June 11, an attacker compromised over 400 packages in the Arch User Repository (AUR) by exploiting a fundamental weakness in community-maintained package systems: abandonment
IncidentWhat Happened In January 2025, Check Point researcher Yarden Porat disclosed three vulnerabilities in LangGraph, a framework for building stateful AI agent workflows. The most severe, CVE-2025-67644 (
IncidentWhat Happened Between late 2023 and early 2024, three incidents highlighted a shift from opportunistic cyber attacks to professional service operations. SafeDep documented the Miasma supply chain atta
IncidentWhat Happened A remote code execution vulnerability was discovered in Celery , a widely-used Python distributed task queue. This flaw allowed attackers to execute arbitrary commands through object tra
IncidentYour AI agent just forwarded AWS credentials to an attacker. The request came through a routine email contact. No exploit kit, no zero-day — just a text field the agent trusted implicitly. Two researc
IncidentWhat Happened Between late 2025 and June 11, 2026, attackers executed a supply chain attack against the Arch User Repository (AUR). They adopted orphaned packages—projects whose original maintainers h
