Expert perspectives on application security, compliance, and emerging threats
IncidentMicrosoft recently expanded its agentic AI security taxonomy with seven new failure modes. These patterns emerged from incidents involving deployed AI systems. If you re running AI agents in productio
IncidentWhat Happened Between March 18 and today, attackers launched over 29,300 attempts to exploit WordPress sites using Everest Forms Pro, a premium form builder plugin. The vulnerability, tracked as CVE-2
IncidentA remote code execution vulnerability in Apache Commons Text surfaced in October 2022, affecting versions 1.5.x through 1.9.x. While not as widespread as Log4Shell, CVE-2022-42889 highlights how trans
IncidentWhat Happened On October 25, 2022, the OpenSSL project announced a critical vulnerability in OpenSSL 3.0.x. The patch was released on November 1, 2022, providing organizations exactly seven days to pr
Get weekly security insights and compliance updates delivered to your inbox.
IncidentA malicious GitHub issue could hijack your entire repository. Security researcher RyotaK demonstrated this by finding a critical flaw in Anthropic s Claude Code GitHub Action, identifying around 50 wa
IncidentWhat Happened Between late 2024 and early 2025, attackers compromised 57 npm packages using a technique that bypasses common security controls. Instead of hiding code in lifecycle scripts like preinst
IncidentIronWorm malware infiltrated 36 npm packages with a single goal: steal everything your CI/CD pipeline knows about your infrastructure. JFrog researchers caught the attack early, but the incident expos
IncidentWhat Happened Hola Browser s Windows distribution was compromised through its software supply chain, resulting in a cryptocurrency miner being bundled with legitimate installations. The malicious exec
IncidentWhat Happened An unauthenticated attacker can execute arbitrary PHP code on Magento stores running the Mirasvit Cache Warmer extension by sending a malicious cookie. CVE-2026-45247 , a PHP object inje
IncidentA prompt injection vulnerability in Google Gemini s voice assistant shows how AI systems can be exploited through seemingly harmless notification channels. Here s what happened, what failed, and what
IncidentOn December 18, 2024, security researchers disclosed a vulnerability in Microsoft Visual Studio Code that allowed attackers to steal GitHub OAuth tokens with a single user click. This attack exploited
IncidentWhat Happened Between late 2024 and early 2025, the Lazarus Group deployed malicious packages on npm that mimicked legitimate ecosystem tools without relying on typosquatting. Sonatype s research team
IncidentWhat Happened Imperva researchers discovered two command injection vulnerabilities in Snyk s CLI and IDE plugins, both rated CVSSv3 5.8. These flaws allowed attackers to execute arbitrary code when de
IncidentWhat Happened On May 5, 2025, Redis released patches addressing CVE-2026-23479, a critical remote code execution vulnerability present since version 7.2.0. This flaw allows authenticated users to exec
IncidentWhat Happened On May 4, 2026, security researcher CHOIGYENGMIN reported CVE-2026-8206 to Wordfence: a critical vulnerability in the Kirki WordPress plugin that allows unauthenticated attackers to hija
IncidentMicrosoft recently updated its security tools to address a critical gap: vulnerability scanners were identifying issues in code, but security teams couldn t determine which ones were significant in pr
