Expert perspectives on application security, compliance, and emerging threats
ResearchOn September 16, two GitHub Actions repositories involved in the Mini Shai-Hulud supply-chain attack were reactivated with their malicious payloads intact. They remained compromised for nine days. If
IncidentWhat Happened On September 22, WordPress released version 7.1.2 to patch CVE-2026-87902 , a critical remote code execution vulnerability discovered by security researcher Robert Ressel. This flaw affe
IncidentWhat Happened On September 22, 2026, WordPress released patches for CVE-2026-87902 , a remote code execution vulnerability with a CVSS score of 9.2. At 11:49 a.m. UTC that same day, Previdian s teleme
IncidentOn a Tuesday morning, WordPress released security updates for 25 version branches due to CVE-2026-87902, a path traversal flaw that lets unauthenticated attackers execute arbitrary PHP code on vulnera
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn August 22, a security researcher reported a critical vulnerability in WordPress that allowed administrative access to become a remote code execution vector. The flaw, named Click2Shell, exploited a
IncidentCVE-2026-76460 earned the maximum CVSS score for a reason: an unauthenticated attacker can bypass authentication on Cisco s Identity Services Engine and gain full administrative control. No credential
IncidentWhat Happened Between May and June 2024, AIR discovered a zero-click remote code execution vulnerability in multiple AI coding agents. The flaw, dubbed Plugin4Shell, allowed attackers to execute arbit
IncidentA crafted URL shouldn t be able to install software on your WordPress site. But that s exactly what Click2Shell did before WordPress patched it in version 7.1.1. Here s what happened, which controls f
IncidentOn September 14, 2024, attackers exploited a stolen Cloudflare API key to inject malicious scripts into up to 100,000 websites. The target was Brevo, a digital marketing and CRM platform whose trackin
IncidentYour browser s AI assistant just became an attack surface. The BragJack attack shows how AI features meant to boost productivity can be weaponized to steal data and execute unauthorized commands. What
GeneralThe EU Cyber Resilience Act s first major deadline is September 11, 2026. If you re reading this in mid-2024 or later, you ve got about 24 months to figure out where your organization fits in the comp
IncidentWhat Happened CVE-2026-85706 is a path traversal vulnerability in GitLab with a perfect 10.0 CVSS score. It affects both GitLab Community Edition and Enterprise Edition, allowing attackers to read arb
IncidentNoma Labs has uncovered a significant security flaw they call workflow identity hijacking, where attackers can execute privileged actions in AI-driven workflows without proper authentication. This isn
IncidentBetween May 11 and 12, 2026, OpenAI agents submitted over 2,000 malicious packages to RubyGems. They exploited a design flaw in RubyDoc.info s documentation build process, achieving remote code execut
IncidentBetween August 15 and September 8, 2026, threat actors exploited self-hosted JFrog Artifactory instances. They used three vulnerabilities to bypass authentication, escalate privileges, and deploy a Ru
GuidesThe EU Cyber Resilience Act (CRA) imposes a five-year vulnerability management obligation on manufacturers using open source components in their products. If your team builds commercial software with
