Expert perspectives on application security, compliance, and emerging threats
ResearchYour security team approved an OAuth app six months ago. The publisher s domain is now parked. The app still has read access to your company s Google Drive. This isn t a hypothetical. An OhAuth audit
ResearchReliaQuest has identified a threat cluster named OP-512 deploying custom web shell frameworks against Microsoft IIS servers, with moderate to high confidence attribution to China-based actors. The fra
ResearchYour package.json scripts are clean. Your lockfile passes integrity checks. You run npm audit before every deployment. Yet, you re still vulnerable to the attack vector that compromised 281 npm packag
ResearchYour build just failed. Someone on the team installed a package that looked legitimate but turned out to be malware. Now you re fielding questions in three different Slack channels while trying to fig
Get weekly security insights and compliance updates delivered to your inbox.
ResearchSocket s research into the TrapDoor campaign reveals a critical issue your security team may have overlooked: developer workstations are now high-value targets. These workstations often run unmonitore
ResearchYou found a Google API key in a public GitHub repo. You deleted it immediately. Your work is done, right? Not for the next 23 minutes. Aikido Security s research confirms that deleted Google API keys
ResearchCISA launched a new nomination form in late 2024 that allows researchers, vendors, and industry partners to submit vulnerabilities directly to the Known Exploited Vulnerabilities (KEV) catalog. Since
ResearchA security researcher deleted a Google API key and watched it authenticate successfully for the next 23 minutes. The provider s documentation claimed immediate deactivation. This gap between promise a
ResearchYour team ships code 55% faster with AI assistance. But when that code breaks in production at 2 AM, can they fix it? This isn t a hypothetical problem. According to Octopus Deploy research, 73% of or
ResearchImagine your team just renewed all your domains. Six months later, one expires because the credit card on file failed. A week after that, someone else registers it. They now control a domain that your
ResearchThe Node-IPC compromise (versions 9.1.6, 9.2.3, and 12.0.1) revealed a critical oversight: attackers are now creating infrastructure-aware operations that map your cloud environment, wait for specific
ResearchAbout six months ago, questions began surfacing in our Slack channels as teams started deploying RAG pipelines to production. A security engineer discovered that their vector database contained custom
ResearchWhen Anthropic released Claude in Chrome, your security team may have assumed the extension would follow the same isolation model as other browser extensions. This assumption was incorrect. LayerX Sec
ResearchBetween July 16 and 22, 2025, three malicious packages—uuid32-utils, colorinal, and termncolor—were on PyPI delivering ZiChatBot malware. They ve been removed, but new threats are constantly emerging.
ResearchWhen a repository triggers code execution before you ve reviewed a single line, your development environment becomes an attack surface. The TrustFall vulnerability in Claude Code highlights this risk:
ResearchUniversity of Massachusetts Dartmouth researchers have introduced VulStyle, a model that detects vulnerabilities by analyzing coding style rather than just syntax or semantics. Pre-trained on approxim
