Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened CVE-2026-42897 , a cross-site scripting (XSS) vulnerability in Microsoft Exchange s Outlook Web Access (OWA), is being actively exploited with no patch available. Attackers can compromis
IncidentOn February 19, 2025, Microsoft and the Institute of Science Tokyo published research documenting a new class of AI model backdoor that bypasses every content-based security control you re running. Th
IncidentBetween January 14 and January 24, 2026, five enterprise software vendors released patches for critical vulnerabilities with CVSS scores ranging from 9.1 to 9.6. If your team manages any combination o
GeneralThe European Cyber Resilience Act (CRA) became enforceable in December 2024, yet awareness is declining. A recent survey found that 66% of respondents remain unfamiliar with the CRA—up from 62% earlie
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Between late 2024 and early 2025, three separate credential-harvesting campaigns targeted npm , PyPI, and Docker Hub within a 48-hour period. These attacks followed a common pattern: com
IncidentA research team at Xidian University has demonstrated a new type of attack that manipulates multimodal AI systems through altered images. This attack, called CrossMPI, achieved a 66.36% average succes
IncidentWhat Happened Between late March and early April 2025, attackers began exploiting CVE-2026-42945 , a critical vulnerability in NGINX that allows denial-of-service attacks and potential remote code exe
GeneralAgentic AI systems are operating in production—processing emails, writing code, booking meetings—and many security teams lack a framework to evaluate their risks. The issue isn t about tools; it s abo
GeneralScope - What This Guide Covers This guide shows you how to use custom scan checks in Burp Suite to automate security expertise across your application portfolio. You ll learn to: Build checks that res
GeneralThe Conventional Wisdom Your compliance team demands audit trails for every AI agent action. They want logs detailing which agent made changes, why it chose specific dependency versions, and who appro
GuidesYour pentest vendor sends a 47-page PDF. Your team triages it into Jira tickets. Developers ask clarifying questions via Slack. The vendor responds three days later via email. By the time you verify t
GeneralYour AI deployment just provisioned 47 service accounts. None of them have owners, none log what they access, and three have write access to your production database. This isn t a hypothetical breach
GeneralScope - What This Guide Covers This guide addresses agentic misalignment in AI systems—when models act against organizational goals or engage in self-preservation behaviors. You ll find implementation
GeneralStraiker s red team discovered 87 exploits across production AI agents, with 24 instances following a pattern called Living Off The Agent (LOTA). If you re deploying autonomous AI agents, your traditi
GuidesYour team adopted Burp Suite six months ago to enhance your web application security testing as part of your SOC 2 Type II preparation. Yet, your scans keep missing SQL injection vulnerabilities that
IncidentWhat Happened Attackers are actively exploiting CVE-2026-42945 , a heap buffer overflow in NGINX s ngx_http_rewrite_module . VulnCheck detected exploitation attempts against their honeypot networks. T
