Expert perspectives on application security, compliance, and emerging threats
IncidentBetween July 14 and August 18, 2026, Wordfence blocked over 440,000 attempts to exploit two critical WordPress plugin vulnerabilities. More than 250,000 targeted CVE-2026-14894 in Super Forms, while a
IncidentWhat Happened Security researchers at SpecterOps have identified 39 methods attackers use to compromise passkey authentication systems. These methods don t break FIDO2 cryptographic protocols. Instead
IncidentWhat Happened On August 19, attackers began exploiting CVE-2026-32475 , a file upload validation vulnerability in Elementor Pro, a popular WordPress page builder plugin. This flaw allows remote code e
IncidentWhat Happened The Shai-Hulud infostealer worm has expanded its credential harvesting from 189 to 469 locations in developer environments, as reported by GitGuardian. This isn t a new threat actor or t
Get weekly security insights and compliance updates delivered to your inbox.
IncidentAI Uncovers Hidden Vulnerabilities OpenAI s Codex Security, an AI-powered code scanning tool, recently scanned over 1.2 million commits and identified 792 critical vulnerabilities, along with 10,561 h
IncidentWhat Happened Attackers are exploiting CVE-2026-0768, a critical vulnerability in Langflow, a low-code platform for building AI workflows. This platform allows teams to assemble LangChain components t
IncidentYour AI development framework just handed attackers root access and every API key in your environment variables. No authentication required. What Happened Attackers exploited CVE-2026-0768 in Langflow
IncidentWhat Happened McKinsey s internal AI platform exposed over 200 documented endpoints to the internet without authentication. External researchers found these APIs, which provided direct access to inter
IncidentWhat Happened On August 28, JFrog disclosed CVE-2026-82329, a critical authentication bypass vulnerability in Artifactory with a CVSS score of 9.8. This flaw allows attackers to gain administrative pr
IncidentOn July 8, 2026, the Open Source Geospatial Foundation (OSGeo) released GeoNetwork versions 4.4.12 and 4.2.17 to fix two vulnerabilities that, when combined, allow unauthenticated remote code executio
IncidentOn the morning after JFrog disclosed CVE-2026-82329, attackers were already scanning for vulnerable Artifactory instances. This authentication bypass flaw lets anyone gain admin-level access to your r
IncidentThe Challenge AI-powered tools have drastically sped up vulnerability discovery, reducing a 60-day research process to just four hours. Major vendors now use models from Anthropic and OpenAI to identi
IncidentWhen you clone a repository, you expect your AI coding assistant to help write code. You don t expect it to execute an attacker s commands without asking. That s exactly what happened with eight vulne
IncidentWhat Happened DryRun Security tested three AI coding agents, OpenAI Codex GPT 5.2, GitHub Copilot Workspace, and Replit Agent, on two application builds. The agents generated code for a task managemen
IncidentWhat Happened On August 28, 2026, JFrog released Artifactory version 7.161.20 to patch CVE-2026-82329 , an authentication bypass vulnerability with a CVSS score of 9.8. Just four days later, on Septem
IncidentCursor s security review system identifies over 200 vulnerabilities weekly across 3,000+ internal pull requests. This isn t a security incident; it s a testament to effective automation. It highlights
