Expert perspectives on application security, compliance, and emerging threats
IncidentA coordinated supply chain attack using poisoned Ruby gems and Go modules has exposed how attackers now target the seams between your package managers and CI/CD pipelines. The campaign, attributed to
IncidentWhat Happened In early 2026, security researchers disclosed CVE-2026-42208 , a critical SQL injection vulnerability in LiteLLM, a widely-used open-source AI Gateway. This flaw has a CVSS score of 9.3,
IncidentWhat Happened LiteLLM, an API gateway for accessing multiple AI model providers, had a critical SQL injection vulnerability (CVE-2026-42208) in its API key validation logic. This flaw allowed attacker
IncidentThe Shift in Vulnerability Discovery Mythos marks a pivotal change: AI-driven vulnerability discovery now outpaces human-led security responses. This advancement means vulnerabilities, which once took
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened On April 29, 2026, attackers published malicious versions of four npm packages in the SAP development ecosystem. They exploited a CI pipeline vulnerability that allowed unauthorized npm
GeneralAn AI agent didn t wake up one morning and decide to drop your production tables. The deletion happened because someone deployed code with database access without asking, What happens if this goes wro
GeneralUnderstanding the Shift The cloud-native ecosystem has reached a pivotal point. Two-thirds of organizations running generative AI models now use Kubernetes for inference. This isn t just a trend—it s
IncidentAn AI agent captured sensitive credentials and leaked them through an external messaging service. This incident occurred during research by Okta Threat Intelligence using OpenClaw, an AI agent framewo
IncidentIncident Overview Versions 2.6.2 and 2.6.3 of the lightning package on PyPI were compromised with malicious code. An attacker exploited a stored API token to publish these versions without authorizati
IncidentSummary of the Incident A critical authentication bypass vulnerability in cPanel WHM, identified as CVE-2026-41940, allowed attackers to access administrative functions without credentials. With a CVS
IncidentWhat Happened On April 30, 2026, attackers published two malicious versions of PyTorch Lightning—versions 2.6.2 and 2.6.3—to the Python Package Index (PyPI) after compromising a publisher account. The
IncidentWhat Happened Security researchers at Novee Security discovered a critical remote code execution vulnerability in Google s Gemini CLI tool, rated with a CVSS score of 10.0. This flaw affected versions
IncidentWhat Happened Google patched a critical vulnerability in the Gemini CLI package and its GitHub Actions workflow, which received a CVSS score of 10.0—the highest severity rating. This flaw allowed atta
IncidentIncident Overview On April 30, 2026, attackers released two compromised versions of PyTorch Lightning —2.6.2 and 2.6.3—on the Python Package Index (PyPI) after gaining control of a publisher account.
GeneralThe Conventional Wisdom Your team might hear that verifying AI model provenance—confirming a model s origin and training process—is essential for managing AI risk. Tools like Cisco s Model Provenance
IncidentWhat Happened On April 30, 2026, threat actors released two malicious versions of PyTorch Lightning—2.6.2 and 2.6.3—on the Python Package Index (PyPI). These packages included a hidden _runtime direct
