Expert perspectives on application security, compliance, and emerging threats
IncidentA contact form shouldn t give an attacker root access to your automation server. But in n8n versions prior to 2.10.1, that s exactly what could happen. Let s walk through how CVE-2026-27577 and CVE-20
GuidesYour developers are already using AI coding assistants. Some of these assistants connect to external servers through Model Context Protocol (MCP). You likely have no visibility into which servers they
IncidentOn March 17, 2025, security researchers at Cyera disclosed CVE-2026-7482 , a critical vulnerability in Ollama that allowed attackers to extract arbitrary memory contents from running AI models. The fl
IncidentWhat Happened In August 2025, threat actor UNC6426 compromised the nx npm package, gaining full AWS administrator access within 72 hours. The attack began with a vulnerable pull_request_target workflo
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn May 1, 2026, attackers began exploiting CVE-2026-29014 , a PHP code injection vulnerability in MetInfo CMS with a CVSS score of 9.8. This flaw allows unauthenticated remote code execution, giving a
GeneralYour team runs 50 Kubernetes clusters. Next quarter, you ll run 200. The year after, maybe 1,000. At some point, the management approach that got you here stops working—but most teams don t realize wh
IncidentWhat Happened In the Firefox 150 release, Mozilla disclosed 271 vulnerabilities discovered by Anthropic s Mythos AI model. This was a controlled discovery process, not a breach, revealing flaws in cod
ResearchWhen Anthropic released Claude in Chrome, your security team may have assumed the extension would follow the same isolation model as other browser extensions. This assumption was incorrect. LayerX Sec
IncidentThe Security Gap in AI Systems Cobalt s State of Pentesting Report highlights a significant gap between AI system security and traditional application security. When pentesters examined AI and LLM imp
IncidentWhat Happened Apache HTTP Server version 2.4.66 contained a double-free vulnerability in its HTTP/2 protocol handling code (CVE-2026-23918). Discovered by Bartlomiej Dmitruk and colleagues, this flaw
IncidentWhat Happened In 2025, attackers compromised the axios JavaScript package—one of the most widely used HTTP client libraries in the Node.js ecosystem—through a malicious transitive dependency. The atta
IncidentOn April 8, attackers compromised DAEMON Tools distribution infrastructure and replaced legitimate installers with trojanized versions. The attack continued through at least mid-April, affecting versi
IncidentBetween April 8 and May 5, 2026, Windows users who downloaded DAEMON Tools from its official website unknowingly installed malware. AVB Disc Soft s legitimate installers were compromised to deliver QU
IncidentWhat Happened A double-free vulnerability in Apache HTTP Server 2.4.66 (CVE-2026-23918, CVSS 8.8) allowed remote attackers to crash servers and potentially execute arbitrary code. The flaw existed in
IncidentThe Overlooked Vulnerability Threat Your Software Composition Analysis (SCA) tool flags 47 vulnerabilities in your production dependencies. You patch them, and your dashboard shows green. But here s t
IncidentWhat Happened Between late 2022 and early 2023, security researchers identified thirteen critical vulnerabilities in vm2 , a widely-used JavaScript sandbox package for Node.js. The most severe, CVE-20
