Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened Phantom Raven is an active AI-native supply chain attack targeting developer environments through compromised open-source packages. This campaign exploits the basic developer workflow: p
IncidentWhat Happened A mid-sized financial services company deployed an AI-powered vulnerability scanning tool in July to support their SOC 2 Type II recertification. The tool integrated with their CI/CD pip
IncidentWhat Happened South Korea s Modu-ui Changup platform, run by the Ministry of SMEs and Startups, leaked personal information and startup business ideas for about 5,000 applicants. The cause was an encr
IncidentThe Problem A security team at a financial services company ran static analysis tools and found 847 vulnerabilities in their codebase. Their reachability scanner confirmed 312 of these could execute.
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Novee s security research team discovered a vulnerability in Cursor, an AI-powered code editor, that allowed full remote code execution on a developer s workstation. The flaw exploited t
IncidentNearly one in three organizations experienced an API breach in the past 12 months. If you re assuming your WAF caught everything, you re using the wrong security model. What Happened Organizations rel
IncidentThe Problem In 2025, nearly one-third of known exploited vulnerabilities were exploited on or before the day they were publicly disclosed. This isn t an isolated incident, it s a widespread issue affe
IncidentWhat Happened A customer-facing LLM chatbot bypassed its safety guardrails when a user submitted input that overrode the system s original instructions. The bot disclosed internal prompts, leaked cust
IncidentWhat Happened Cyera disclosed a path traversal vulnerability in LangChain, tracked as CVE-2026-34070, with a CVSS score of 7.5. This flaw lets attackers access files outside intended directories by ma
IncidentA researcher used AI to review code, and within minutes, it flagged critical vulnerabilities in two widely used text editors. What Happened In early 2025, researcher Hung Nguyen employed Anthropic s C
IncidentGitHub s AI-powered scanning feature wasn t launched because their existing tools were flawless. It launched because traditional static analysis has blind spots, and those blind spots cost companies r
IncidentThe Visibility Problem Between 2024 and 2025, enterprise AI agent deployments surged. Security teams gained powerful automation tools capable of querying databases, calling APIs, and orchestrating wor
IncidentWhat Happened OpenAI president Greg Brockman published a blog post urging CISOs to adopt agentic AI systems, specifically recommending OpenAI s own products. His pitch is that company systems are hidi
IncidentOn August 19, 2026, Adversa AI extracted private session data from xAI s Grok chatbot using a technique called Cryptographic Context Injection. This attack embeds encrypted instructions in web content
IncidentIn June 2016, an attacker drained approximately $60 million in Ether from The DAO smart contract. The vulnerability was a reentrancy bug that let the attacker repeatedly call the withdrawal function b
IncidentWhat Happened On January 29, 2025, GitLab released patches for CVE-2026-19478, a critical vulnerability with a CVSS score of 9.4. The flaw affects GitLab versions 18.2 before 18.11.11, 19.0 before 19.
