Expert perspectives on application security, compliance, and emerging threats
GeneralYour web agents can read natural language. So can attackers. Cross-Site Prompting (XSP) exploits the same trust boundary weakness as Cross-Site Scripting, but instead of injecting JavaScript, attacker
DeadlinesYour Kubernetes controllers worked fine at 50 nodes. Now you re planning for 5,000, and you need to ensure they won t crash, leak resources, or create security gaps. This checklist walks through the o
IncidentWhat Happened OpenAI s automated red-teaming system, GPT-Red, successfully attacked a production AI agent and convinced it to reprice inventory. Items normally priced above $100 were marked down to $0
GeneralYou ve locked down your API keys, you re running static analysis on your codebase, and your network security team has implemented zero trust for human users. When your engineering team proposes deploy
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Bugcrowd recently revised its submission policies after a surge of low-quality, AI-generated vulnerability reports. Researchers submitted findings that looked polished but lacked proof t
GeneralYou ve probably heard it: AI coding assistants have boosted developer productivity so much that code review is now the bottleneck. GitLab s research suggests this shift. Your team might be discussing
IncidentThe Problem In 2024, CISA and four international cybersecurity agencies released joint guidance urging software vendors to establish formal coordinated vulnerability disclosure (CVD) programs. This wa
IncidentOn June 24, 2026, n8n patched CVE-2026-59208, a vulnerability in their token exchange mechanism that allowed attackers to authenticate as users from a different token issuer. If your Enterprise instan
GeneralThe Conventional Wisdom Security teams are rushing to buy AI agent security platforms. The pitch sounds reasonable: AI agents move too fast for humans to monitor, they access systems autonomously, and
IncidentSAP s July 2026 security update included CVE-2026-44747 , an out-of-bounds write vulnerability in NetWeaver Application Server ABAP with a CVSS score of 9.9. This flaw allows an authenticated attacker
IncidentWhat Happened Between May and July 2026, attackers exploited CVE-2026-46817 , a critical Oracle E-Business Suite vulnerability that allows unauthenticated remote code execution. Oracle released a patc
IncidentWhat Happened OpenAI used GPT-Red, an automated adversarial testing system, to identify prompt injection vulnerabilities in GPT-5.6 Sol before its release. The testing showed that earlier versions wer
IncidentWhen the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published new guidance on coordinated vulnerability disclosure programs in late 2024, it admitted its own reporting channels had f
IncidentIn December 2024, researchers at Seoul National University demonstrated a new attack that made AI agents perform unintended actions. This attack succeeded up to 50% of the time against current defense
IncidentWhat Happened Anthropic s Claude for Chrome extension has two vulnerabilities that allow malicious browser extensions to hijack the AI s capabilities to read and exfiltrate user data. Security researc
IncidentWhat Happened Progress Software discovered a zero-day vulnerability in ShareFile Storage Zone Controllers and made an unusual decision: release patches immediately but delay the CVE publication for tw
