Expert perspectives on application security, compliance, and emerging threats
IncidentIn March 2026, the TeamPCP attack compromised Trivy, Checkmarx, LiteLLM, and dozens of npm packages. Security teams knew about the vulnerabilities. They d logged tickets, assigned severity scores, and
IncidentWhat Happened On July 15, F5 patched CVE-2026-42533, a heap buffer overflow in nginx that allows remote attackers to crash worker processes and potentially execute arbitrary code. The vulnerability af
IncidentWhat Happened Attackers have found a way to spoof OAuth client IDs to bypass Microsoft Entra ID sign-in logs. By using a fake OAuth client ID during authentication, the sign-in event either doesn t ap
GeneralYour team reviews code after it s written. The data suggests you should flip that around. What Changed Code review started around 2006 when Google formalized internal practices. For nearly two decades
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened In the past 18 months, security teams have noticed a shift in how attackers probe their systems. SQL injection vulnerabilities that sat dormant in quarterly scan reports for years are no
GeneralYour developers are shipping AI agents that need database passwords, API keys, and service account credentials. Meanwhile, your security team is discovering these secrets hardcoded in configuration fi
IncidentWhat Happened In early 2026, Searchlight Cyber discovered two critical remote code execution vulnerabilities in WordPress Core, tracked as CVE-2026-63030 and CVE-2026-60137. These vulnerabilities, kno
IncidentOn January 29, 2025, the WordPress security team disclosed two high-severity vulnerabilities affecting WordPress 6.9 and the 7.1 beta release. Both issues, tracked as CVE-2026-60137 and CVE-2026-63030
IncidentOn July 18, 2026, WordPress released emergency patches for versions 6.9 and 7.0 to fix a critical remote code execution vulnerability. The flaw, known as wp2shell, combines CVE-2026-63030 and CVE-2026
GeneralYou ve got three years before the Cyber Resilience Act makes Software Bills of Materials (SBOMs) mandatory in Europe. That deadline is at the end of 2027, and if you re selling software into EU market
IncidentIn June 2024, OpenSSL released version 3.3.1 containing a fix for what Okta s security team later named HollowByte, a flaw that lets an attacker freeze server memory with minimal TLS requests. You wou
GeneralGoogle released two infrastructure projects in May 2026 that reveal where AI workloads are breaking Kubernetes: Agent Substrate and Agent Sandbox. These tools show that traditional container orchestra
IncidentWhat Happened Between March and June 2026, OWASP CVE Lite CLI went from initial release to Lab Project status in just three months. The tool accumulated 621 GitHub stars, over 100 forks, and more than
IncidentOn January 13, 2025, AsyncAPI discovered that several of its npm packages had been compromised and were distributing malware. Three days later, Jscrambler reported a similar incident affecting its pac
IncidentBetween June 29 and July 3, 2026, a threat actor published seven malicious npm packages targeting developers using Vite, a popular frontend build tool. Checkmarx discovered the campaign, dubbed ViteVe
IncidentA Go-based botnet named NadMesh has been actively scanning for exposed AI services and harvesting cloud credentials. Research from QiAnXin s XLab reveals that the botnet s operator claims to have coll
