Expert perspectives on application security, compliance, and emerging threats
GeneralStatic scanning tools can t keep up with obfuscated AI agent skills. Research from Hong Kong University of Science and Technology shows that SkillCloak, a tool designed to hide malicious code in AI ag
StandardsThese questions arise when someone discovers the OWASP API Security Top 10 2023 (released June 5, 2023), and their team is already deploying new endpoints. They re trying to understand what Broken Obj
StandardsYour web application accepts user input, validates it with a regex pattern, and suddenly your server s CPU spikes to 100%. A single malicious string just triggered a Regular expression Denial of Servi
IncidentWhat Happened Zimbra released version 10.1.19 to fix a critical stored cross-site scripting (XSS) vulnerability in its Classic Web Client. Google s Threat Analysis Group reported the flaw, highlightin
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Datadog Security Labs identified coordinated reconnaissance campaigns using over 50 dormant GitHub accounts to map corporate organizations. Attackers issued API queries through accounts
IncidentWhat Happened Zimbra disclosed a stored cross-site scripting (XSS) vulnerability in its Classic Web Client. This flaw allows specially crafted emails to execute malicious scripts in a user s session.
IncidentWhat Happened A mid-market SaaS company discovered unauthorized data access in their production environment. The entry point wasn t their code. An attacker exploited a known vulnerability in a third-p
IncidentWhat Happened A software supply chain compromise occurred when your team integrated what appeared to be a clean open-source dependency. The package showed zero CVEs in your security scanning tools. Th
IncidentA research team at the University of Missouri-Kansas City has published proof-of-concept code for an attack that bypasses AI code review tools by hiding malicious instructions inside PNG files attache
GeneralThe conventional wisdom: AI coding assistants are a smart investment. For $19-$200/month per developer, you get faster code completion, automated boilerplate, and productivity gains that justify the s
IncidentWhat Happened On July 8, 2026, a threat actor published version 1.20.21 of @injectivelabs/sdk-ts to npm. The package contained code to steal cryptocurrency wallet private keys. Within 24 hours, the at
IncidentOn January 14, 2025, security researcher Michael Clark confirmed what Sysdig had already detected: attackers were exploiting CVE-2026-20896 to bypass authentication in Gitea Docker deployments. This v
GuidesYou ve deployed a DLP solution. Now you need policies that actually work. Most organizations start with vendor defaults or copy-paste rules that trigger thousands of false positives. Within weeks, you
ResearchUnderstanding the Concerns Recently, I ve observed heated debates among security engineers about whether to restrict GitHub Copilot in their environments. The discussions often lack concrete data on h
IncidentThe Problem Organizations are facing a systemic issue: 82% carry security debt, meaning they have unresolved vulnerabilities older than a year. These aren t hypothetical risks; they re real flaws in y
IncidentUbiquiti recently released security updates for UniFi OS, addressing seven critical vulnerabilities. One of these, CVE-2026-50746, has a maximum CVSS severity score. Censys data shows over 100,000 Uni
