Expert perspectives on application security, compliance, and emerging threats
GeneralYour organization just bought an AI code review tool. Now someone in leadership is asking why you still need manual peer review at all. If the AI catches the bugs, why slow down deployment with human
IncidentF5 disclosed two critical remote code execution vulnerabilities in NGINX Open Source on January 14, 2025. Both CVE-2026-42530 and CVE-2026-42055 carry CVSS v4 scores of 9.2. If your team is running NG
IncidentWhat Happened Researchers at Hong Kong University of Science and Technology have discovered a denial-of-service attack that exploits AI agent safety systems. This attack, known as reasoning-extension
IncidentYour security information and event management (SIEM) platform should detect intrusions, not enable them. However, in June 2026, organizations running unpatched Splunk Enterprise found themselves in a
Get weekly security insights and compliance updates delivered to your inbox.
ResearchWhen Microsoft disclosed the AutoJack vulnerability in AutoGen Studio, the attack vector was clear: three layered weaknesses in the Model Context Protocol (MCP) WebSocket implementation allowed malici
GeneralSecurity teams often focus on data exfiltration when considering AI risks. Your DLP alerts fire when someone pastes code into ChatGPT. Your CASB flags uploads to Claude. You ve probably written a poli
StandardsScope - What This Guide Covers This guide focuses on implementing machine identity security programs. You ll find specific controls for service accounts, API keys, certificates, tokens, and AI agents
GeneralMany organizations mistakenly treat AI agents as mere software tools. They configure them once, rotate an API key occasionally, and assume they re secure. This approach is flawed and leads to security
IncidentWhat Happened Varonis Threat Labs revealed a prompt injection attack against Microsoft M365 Copilot Enterprise that exposed internal corporate data through manipulated URL parameters. The attack, call
IncidentA vulnerability fix in a widely-used Golang JWT package was never merged into the version most developers used. This oversight left projects exposed to authentication bypass, despite the existence of
IncidentWhat Happened Novo Nordisk experienced a security breach when an attacker accessed its systems through a leaked GitHub token. This token, a credential for automated systems to interact with the compan
IncidentWhat Happened Your developers store credentials on their laptops. Git history, environment files, configuration snippets, and API keys are all vulnerable on machines that connect to public WiFi, run u
GeneralScope This guide focuses on governance frameworks for AI-assisted code generation in organizations where employees use tools like Claude Code, GitHub Copilot, or ChatGPT to create applications outside
ResearchYou ve sat through the vendor demo. The slide deck claims 99% accuracy in bold letters. The sales engineer points to benchmark results showing their tool catches more vulnerabilities than competitors.
IncidentWhat Happened F5 released emergency security patches for critical vulnerabilities in NGINX web server modules. Two vulnerabilities—CVE-2026-42530 and CVE-2026-42055—allow unauthenticated remote attack
IncidentWhat Happened ShapedPlugin s distribution system was compromised, allowing attackers to inject malware into three premium WordPress plugins via the official update mechanism. The backdoor impersonated
