Expert perspectives on application security, compliance, and emerging threats
GeneralYou re maintaining a payment processing service that depends on 247 open source packages. Eighteen of them haven t seen a commit in over two years. Three have known CVEs with no patches coming. Your c
GeneralOver the past year, fewer companies are relying on AI systems for penetration testing. This isn t a failure of innovation—it s a market correction after inflated expectations met operational reality.
GeneralYour AI coding assistant just wrote 6,000 lines of code. It compiled. Tests passed. Your CI pipeline is green. But when a verification agent checked those same 6,000 lines against your team s actual r
IncidentWhat Happened Attackers are exploiting CVE-2026-12569 , a remote code execution vulnerability in PTC Windchill, to deploy web shells on vulnerable systems. The flaw has a CVSS score of 9.3. CISA added
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened SentinelLabs identified malware targeting MacOS systems that contains instructions designed to make LLM-assisted security products abort their analysis. The malware, detected under the r
DeadlinesThe proposed AI Incident Reporting Act mandates that developers of advanced AI models report major safety and security incidents to the Commerce Department within seven days of discovery. With civil p
IncidentWhat Happened On June 25, 2026, researchers identified a supply chain breach affecting the Leo Platform ecosystem on npm. Sonatype found 23 malicious package versions linked to the Shai-Hulud Miasma c
IncidentA supply chain attack targeting npm packages and GitHub Actions workflows revealed how attackers can now move across package ecosystems to harvest developer credentials at scale. The Miasma malware ca
IncidentIn January 2025, Polymarket users experienced a significant security breach when $3 million in cryptocurrency vanished from their wallets. The culprit? Malicious JavaScript injected through a third-pa
IncidentWhat Happened In August 2019, an attacker compromised a maintainer s RubyGems account for the rest-client library and inserted malicious code into versions 1.6.11 through 1.6.13. This backdoor allowed
IncidentThe Linux Foundation announced Akrites in early 2025, introducing it as a shared Security Incident Response Team (SIRT) and Coordinated Vulnerability Disclosure (CVD) process for open-source projects.
ResearchYou re building AI-powered research tools. Your agents pull from Reddit, Stack Overflow, and community forums because that s where real-world knowledge lives. But here s what Cornell Tech just proved:
IncidentWhat Happened Your .NET development team might spend weeks triaging vulnerability alerts from your software composition analysis (SCA) tool. Imagine your application pulls in 4,200 NuGet packages acro
IncidentWhat Happened Security researchers have found that modern LLMs rely heavily on role tags—such as system prompts and user designations—as their primary security framework. However, these tags do not pe
GeneralScope - What This Guide Covers This guide provides the security controls and response protocols your team needs when deploying large language models (LLMs) in production environments. The rapid jailbr
IncidentIn June 2019, Snyk discovered SQL injection vulnerabilities in Sequelize, a widely-used ORM library in the Node.js ecosystem. These flaws affected versions below 5.8.11 for MySQL and MariaDB, and vers
