Expert perspectives on application security, compliance, and emerging threats
IncidentIntroduction In 2026, Frost Sullivan recognized Picus Security as the Innovation Index Leader in their Frost Radar report on Automated Security Validation. This accolade wasn t for minor tweaks to exi
IncidentA vulnerability in Ruby on Rails libvips image processing library (CVE-2026-66066) has been actively exploited since early March 2024. VulnCheck recorded more than 360 exploitation attempts within the
IncidentWhat Happened A development team using LLM-assisted code generation released multiple pull requests containing hardcoded API keys, database credentials, and overly permissive access controls. The code
IncidentWhat Happened Researchers found that AI coding agents can follow hidden instructions in project README files, even if those instructions lead to data leaks. In tests using ReadSecBench, a specialized
Get weekly security insights and compliance updates delivered to your inbox.
IncidentIncident Overview An AI-powered customer service system fell victim to a malicious prompt that extracted internal knowledge base content and exposed it to an unauthorized user. The attack succeeded be
IncidentWhat Happened Internet-wide scanning has revealed 175,000 Ollama servers with publicly accessible APIs. Ollama, a tool for running large language models locally or on cloud infrastructure, exposes a R
IncidentA supply chain attack compromised 19 Chrome and Edge extensions between December 2024 and January 2025. Attackers acquired legitimate extensions, pushed malicious updates through official channels, an
IncidentOn January 16, 2025, security researchers disclosed a vulnerability in the GiveWP WordPress plugin that earned a perfect 10.0 CVSS score. CVE-2026-82222 joins four other critical flaws affecting widel
IncidentWhat Happened Google has announced it will no longer accept AI-generated submissions to its Open Source Software Vulnerability Reward Program (VRP). This decision follows a trend of low-quality report
IncidentThe XM Cyber threat research team identified eight distinct attack vectors in AWS Bedrock environments. None of these exploits rely on zero-days or novel techniques. They all hinge on a single point o
IncidentWhat Happened On August 27, 2026, ServiceNow disclosed four vulnerabilities in its AI Platform, with three rated at the highest severity level, CVSS 10.0. These flaws allow attackers to execute arbitr
IncidentServiceNow disclosed three critical vulnerabilities in its AI Platform on January 14, 2025. All three received CVSS scores at maximum severity. The flaws, CVE-2026-18885 (code injection), CVE-2026-188
IncidentWhat Happened ServiceNow patched three critical vulnerabilities in its AI Platform that allowed unauthenticated attackers to execute arbitrary code and SQL statements without user interaction. The vul
IncidentIn April 2026, NIST reclassified roughly 30,000 vulnerabilities in the National Vulnerability Database as Not Scheduled. If your team relied on NVD as your single source of truth, you just lost visibi
IncidentAn unauthenticated attacker just created an admin account on a nonprofit s WordPress site. They didn t need credentials or exploit a complex chain. They sent a single HTTP request to a donation form.
IncidentThe Threat Landscape In 2025, financial services organizations blocked 893 malicious packages from entering their development environments. By mid-2026, they d intercepted 572 more. These packages wer
