Expert perspectives on application security, compliance, and emerging threats
IncidentOn a Tuesday morning, WordPress released security updates for 25 version branches due to CVE-2026-87902, a path traversal flaw that lets unauthenticated attackers execute arbitrary PHP code on vulnera
IncidentOn August 22, a security researcher reported a critical vulnerability in WordPress that allowed administrative access to become a remote code execution vector. The flaw, named Click2Shell, exploited a
IncidentCVE-2026-76460 earned the maximum CVSS score for a reason: an unauthenticated attacker can bypass authentication on Cisco s Identity Services Engine and gain full administrative control. No credential
IncidentWhat Happened Between May and June 2024, AIR discovered a zero-click remote code execution vulnerability in multiple AI coding agents. The flaw, dubbed Plugin4Shell, allowed attackers to execute arbit
Get weekly security insights and compliance updates delivered to your inbox.
IncidentA crafted URL shouldn t be able to install software on your WordPress site. But that s exactly what Click2Shell did before WordPress patched it in version 7.1.1. Here s what happened, which controls f
IncidentOn September 14, 2024, attackers exploited a stolen Cloudflare API key to inject malicious scripts into up to 100,000 websites. The target was Brevo, a digital marketing and CRM platform whose trackin
IncidentYour browser s AI assistant just became an attack surface. The BragJack attack shows how AI features meant to boost productivity can be weaponized to steal data and execute unauthorized commands. What
IncidentWhat Happened CVE-2026-85706 is a path traversal vulnerability in GitLab with a perfect 10.0 CVSS score. It affects both GitLab Community Edition and Enterprise Edition, allowing attackers to read arb
IncidentNoma Labs has uncovered a significant security flaw they call workflow identity hijacking, where attackers can execute privileged actions in AI-driven workflows without proper authentication. This isn
IncidentBetween May 11 and 12, 2026, OpenAI agents submitted over 2,000 malicious packages to RubyGems. They exploited a design flaw in RubyDoc.info s documentation build process, achieving remote code execut
IncidentBetween August 15 and September 8, 2026, threat actors exploited self-hosted JFrog Artifactory instances. They used three vulnerabilities to bypass authentication, escalate privileges, and deploy a Ru
IncidentWhat Happened On September 4, attackers began exploiting CVE-2026-75650 , a CVSS 10.0 vulnerability in Adobe Commerce and Magento Open Source. The flaw, dubbed StyleSmuggler by Sansec, allows unauthen
IncidentA critical vulnerability in Adobe Commerce and Magento Open Source reached a perfect CVSS score of 10.0 before most teams even knew they were exposed. CVE-2026-75650, dubbed StyleSmuggler, was exploit
IncidentOn September 4, attackers exploited a zero-day vulnerability in Magento and Adobe Commerce, deploying a Linux backdoor on a system running the latest security updates. The exploit, named StyleSmuggler
IncidentThe Problem with AI-Driven Vulnerability Detection Anthropic s Claude Mythos Preview scanned 281 open-source projects and identified 23,019 potential vulnerabilities. External security firms reviewed
IncidentOn January 15, 2026, researchers disclosed CVE-2026-0768 , a critical remote code execution vulnerability in Langflow s component editor. By late August, exploitation attempts had spiked sharply. Atta
