Expert perspectives on application security, compliance, and emerging threats
GuidesYour AI infrastructure likely uses RSA-2048 or ECDSA P-256 for authentication and encryption. Both will become vulnerable when large-scale quantum computers arrive. The timeline is uncertain, but the
IncidentWhat Happened Attackers are exploiting CVE-2026-0768, a critical vulnerability in Langflow, a low-code platform for building AI workflows. This platform allows teams to assemble LangChain components t
IncidentYour AI development framework just handed attackers root access and every API key in your environment variables. No authentication required. What Happened Attackers exploited CVE-2026-0768 in Langflow
IncidentWhat Happened McKinsey s internal AI platform exposed over 200 documented endpoints to the internet without authentication. External researchers found these APIs, which provided direct access to inter
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened On August 28, JFrog disclosed CVE-2026-82329, a critical authentication bypass vulnerability in Artifactory with a CVSS score of 9.8. This flaw allows attackers to gain administrative pr
GeneralYour team runs Gitleaks. You ve got pre-commit hooks. You scan every PR. So you re protected from credential leaks, right? Not exactly. The arrival of Betterleaks, a next-generation fork of Gitleaks d
IncidentOn July 8, 2026, the Open Source Geospatial Foundation (OSGeo) released GeoNetwork versions 4.4.12 and 4.2.17 to fix two vulnerabilities that, when combined, allow unauthenticated remote code executio
ResearchYour compliance team hands you a spreadsheet with 247 controls from three different frameworks. Your job: map them to your CI/CD pipeline, container runtime, and secrets management system. The spreads
IncidentOn the morning after JFrog disclosed CVE-2026-82329, attackers were already scanning for vulnerable Artifactory instances. This authentication bypass flaw lets anyone gain admin-level access to your r
GeneralThe conventional wisdom : Organizations should adopt AI pentesting tools to replace manual security testing because automation is faster, more comprehensive, and catches vulnerabilities that humans mi
IncidentThe Challenge AI-powered tools have drastically sped up vulnerability discovery, reducing a 60-day research process to just four hours. Major vendors now use models from Anthropic and OpenAI to identi
GeneralYour engineering team is shipping features with AI models they found on Hugging Face. Your data science group is testing LLMs through third-party APIs. Your support team just integrated a chatbot some
IncidentWhen you clone a repository, you expect your AI coding assistant to help write code. You don t expect it to execute an attacker s commands without asking. That s exactly what happened with eight vulne
GeneralThe OpenSSF Tech Talk on March 17, 2026, at 1:00 PM ET marks a significant shift in classifying AI security vulnerabilities. Angela McNeal will discuss agent autonomy and context integrity as new secu
GeneralScope: What This Guide Covers This guide helps you allocate tasks between AI coding agents and human developers. If you re integrating AI coding tools into your development workflow, you need a system
IncidentWhat Happened DryRun Security tested three AI coding agents, OpenAI Codex GPT 5.2, GitHub Copilot Workspace, and Replit Agent, on two application builds. The agents generated code for a task managemen
