Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1442 Security Engineers1022 Compliance Teams275 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All1442 Incident913 General270 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

1442 articlesSort byNewest·Trending

AI Agents Don't Wait for Approval Tickets

General

Latest

6 min read

AI Agents Don't Wait for Approval Tickets

Your compliance framework was built for humans who submit tickets, wait for reviews, and access data at a measured pace. AI agents don t work that way. They query databases hundreds of times per hour,

For Compliance TeamsRead article

Microsoft Drops Two Safety Tools for AI Agents

General

4 min read

Microsoft Drops Two Safety Tools for AI Agents

Microsoft has released Rampart and Clarity as open-source projects, offering new ways for organizations to enhance AI agent security. These tools address a critical issue: AI agents now execute code,

For Security EngineersRead

Incident

3 min read

ASAPP's Red Team Finds 50+ Flaws Daily

Introduction: The Need for Continuous Adversarial Testing ASAPP, an enterprise AI provider, identified a significant gap in their security strategy: traditional pre-deployment testing couldn t keep up

For Security EngineersRead

Incident

4 min read

700 Malicious Versions in 24 Hours

On a quiet Tuesday, the Laravel-Lang organization s PHP localization packages became a delivery mechanism for credential theft across Windows, Linux, and macOS systems. More than 700 compromised packa

For Compliance TeamsRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Shai-Hulud npm Attack: What Broke and What to Fix

Incident

4 min read

Shai-Hulud npm Attack: What Broke and What to Fix

Incident Overview In the Shai-Hulud incident, attackers published malicious npm packages containing hidden exfiltration scripts. These packages bypassed initial security checks and infiltrated product

For Security EngineersRead

15,000 Exploit Attempts in Days: The Drupal SQL Injection Timeline

Incident

4 min read

15,000 Exploit Attempts in Days: The Drupal SQL Injection Timeline

What Happened CVE-2026-9082 , a SQL injection vulnerability in Drupal Core with a CVSS score of 6.5, moved from patch release to active exploitation faster than most security teams could deploy fixes.

For Security EngineersRead

AI Models in Your Supply Chain: A Governance Gap Audit

General

5 min read

AI Models in Your Supply Chain: A Governance Gap Audit

Scope - What This Guide Covers This guide addresses the governance gap between AI model acquisition and your existing software supply chain controls. You ll find requirement mappings, implementation s

For Compliance TeamsRead

Drupal SQL Injection: When Risk Scores Collide

Incident

4 min read

Drupal SQL Injection: When Risk Scores Collide

What Happened Drupal disclosed CVE-2026-9082 , a SQL injection vulnerability in its database abstraction API that allows unauthorized database access and potential remote code execution. The flaw affe

For Compliance TeamsRead

Incident

4 min read

5,561 Repos Compromised in Six Hours

An attacker pushed 5,718 malicious commits across 5,561 GitHub repositories in just six hours. This campaign, known as Megalodon, didn t rely on a zero-day or novel vulnerability. Instead, it exploite

For Security EngineersRead

You Just Deleted a Compromised API Key. Now What?

Research

5 min read

You Just Deleted a Compromised API Key. Now What?

You found a Google API key in a public GitHub repo. You deleted it immediately. Your work is done, right? Not for the next 23 minutes. Aikido Security s research confirms that deleted Google API keys

For Security EngineersRead

WordPress Plugin Backdoor: 300 Zero-Days in 72 Hours

Incident

4 min read

WordPress Plugin Backdoor: 300 Zero-Days in 72 Hours

What Happened Between late 2024 and early 2025, TrendAI and CHT Security used an AI-driven static analysis system to scan WordPress plugins. This system uncovered over 300 critical zero-day vulnerabil

For Security EngineersRead

Two Major Breaches, One Supply Chain Failure

Incident

5 min read

Two Major Breaches, One Supply Chain Failure

On January 15, 2025, GitHub disclosed that attackers accessed internal repositories and exfiltrated source code. Days later, Grafana Labs confirmed a similar breach. Both incidents traced back to a su

For Security EngineersRead

Open-Source AI Security Tools Won't Fix Your Problems

General

4 min read

Open-Source AI Security Tools Won't Fix Your Problems

The Conventional Wisdom Security teams are excited about Microsoft s release of Clarity and RAMPART, viewing them as transformative for AI security. The idea is straightforward: integrate these open-s

For Security EngineersRead

Two KEV Additions, One Lesson: Patch Before Threat Actors Do

Incident

4 min read

Two KEV Additions, One Lesson: Patch Before Threat Actors Do

What Happened Between May 15 and May 21, 2025, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. CVE-2025-34291, an origin valid

For Security EngineersRead

Incident

3 min read

Treasury Breach: A 15-Year-Old Flaw

What Happened In December 2024, state-sponsored attackers exploited a PostgreSQL SQL injection zero-day to infiltrate the US Treasury. This vulnerability allowed them to bypass authentication controls

For Security EngineersRead

ChromaDB CVE-2026-45829: Race Condition to RCE

Incident

3 min read

ChromaDB CVE-2026-45829: Race Condition to RCE

Overview of the Vulnerability ChromaDB versions 1.0.0 through 1.5.8 have a critical vulnerability allowing unauthenticated remote code execution. The flaw, tracked as CVE-2026-45829, exploits a race c

For Security EngineersRead

Showing 961-976 of 1442 articles

PreviousPage 61 of 91Next