Expert perspectives on application security, compliance, and emerging threats
IncidentIncident Overview A threat actor compromised CI/CD pipelines by deploying malicious code through an open source security tool. This attack used an infostealer to exfiltrate cloud credentials, SSH keys
IncidentWhat Happened On March 22, 2026, threat actor TeamPCP compromised the Trivy vulnerability scanner s Docker Hub distribution channel and attacked Aqua Security s GitHub infrastructure. Malicious versio
IncidentIncident Overview On March 23, 2026, an attacker published malicious versions of two Checkmarx plugins to the OpenVSX registry: ast-results-2.53.0.vsix and cx-dev-assist-1.7.0.vsix. Between 12:58 and
IncidentIn late 2024, Microsoft s Security Response Center documented a coordinated attempt to manipulate enterprise AI assistants through carefully crafted prompts. Attackers used role-playing scenarios and
Get weekly security insights and compliance updates delivered to your inbox.
GeneralOrganizations often rely on automated scanning tools to detect malicious packages in their dependency chains. The belief is that if you can scan quickly and block threats within seconds, you re protec
IncidentOn March 22, 2025, Aqua Security detected unauthorized Docker image tags for Trivy—their widely-used container vulnerability scanner—appearing without corresponding GitHub releases. The investigation
IncidentWhat Happened Security researcher Mihalis Haatainen discovered a critical vulnerability in Azure API Management Developer Portals: disabling self-signup in the administrative interface doesn t actuall
IncidentWhat Happened GitGuardian s State of Secrets Sprawl 2026 reported 28.65 million new hardcoded secrets committed to public GitHub repositories during 2025. These included not only API keys from legacy
IncidentWhat Happened The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-33017 to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a remote code exec
IncidentWhat Happened Malicious versions of LiteLLM, a Python middleware for LLM API calls, were available on PyPI for about two hours. These versions contained malware designed to steal cloud provider keys a
IncidentImmediate Threat Overview On January 16, 2025, researchers disclosed CVE-2026-33017 , a critical vulnerability in Langflow versions 1.8.2 and earlier, allowing unauthenticated remote code execution. W
IncidentWhat Happened Threat actors exploited a code injection vulnerability in Langflow, an AI platform for building LLM-powered applications, within hours of its public disclosure. This vulnerability allowe
IncidentOn March 24, the cybercriminal group TeamPCP uploaded malicious versions 1.82.7 and 1.82.8 of LiteLLM—a popular Python library for AI application development—to the Python Package Index (PyPI). These
IncidentWhat happened TeamPCP, a threat actor group, published two malicious versions of the legitimate Telnyx package on the Python Package Index (PyPI) . Versions 4.87.1 and 4.87.2 contained malware hidden
GuidesThe CISA guide on agentic AI security highlights a critical debate for security engineers: should autonomous AI systems be treated as privileged users needing identity controls, or as application comp
IncidentWhat Happened In the past 18 months, organizations using AI systems have faced security failures that traditional identity-based controls couldn t stop. While no single breach stands out, the overall
