Expert perspectives on application security, compliance, and emerging threats
ResearchCISA launched a new nomination form in late 2024 that allows researchers, vendors, and industry partners to submit vulnerabilities directly to the Known Exploited Vulnerabilities (KEV) catalog. Since
IncidentAn AI agent you deploy to automate customer support queries suddenly starts leaking API keys to an external server. Your incident response team traces it back to a helpful skill you installed three we
IncidentIntroduction Google s integration of CodeMender, an AI-powered vulnerability remediation agent, into the Gemini Enterprise Agent Platform marks a strategic shift in AI security governance. This move d
IncidentWhat Happened CVE-2026-44575 allows attackers to bypass middleware-based authorization controls in Next.js App Router applications through manipulated request paths. The vulnerability affects Next.js
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn May 18, 2026, GitHub disclosed a breach of its internal repositories. The attack vector: a trojanized VS Code extension called Nx Console, maintained by Narwhal Technologies. The compromised versio
ResearchA security researcher deleted a Google API key and watched it authenticate successfully for the next 23 minutes. The provider s documentation claimed immediate deactivation. This gap between promise a
IncidentWhat Happened Attackers compromised the Nx Console VS Code extension and published a malicious version to the Visual Studio Marketplace. This version exfiltrated authentication tokens from developers
GeneralYour AI system doesn t ship with a parts list. That s the problem. When you deploy a containerized application, you generate an SBOM showing every library, version, and dependency. When you deploy an
IncidentWhat Happened Between late 2024 and early 2025, attackers compromised two versions of the npm package @common-stack/generate-plugin (9.0.2-alpha.21 and 9.0.2-alpha.22). The package, which sees over 1,
GeneralSecurity engineers have spent decades developing reliable methods to measure software security. However, with the advent of AI systems, these measurements have become ineffective. The issue isn t that
GeneralYour AI agent just guided a developer through installing a malicious package. Your static analysis tools found nothing wrong. Your endpoint detection and response (EDR) didn t trigger. Your code revie
IncidentWhat Happened Drupal recently released emergency security updates for six supported versions to patch CVE-2026-9082 , a vulnerability that allows anonymous users to execute remote code on sites using
IncidentEquifax s Security Oversight In 2017, Equifax suffered a massive data breach that exposed the personal information of 147 million people. The breach was due to an unpatched Apache Struts vulnerability
IncidentOverview of the Vulnerability Drupal has released emergency patches for CVE-2026-9082, a critical SQL injection vulnerability affecting sites using PostgreSQL. This issue required coordinated patches
GeneralMicrosoft has released two open-source tools that transform AI agent security testing: RAMPART and Clarity. RAMPART is a Pytest-native safety and security testing framework, while Clarity serves as a
IncidentWhat Happened On May 1, 2025, Grafana detected unauthorized access to its private GitHub repositories. The attacker exploited a single GitHub workflow token that should have been rotated weeks earlier
