Expert perspectives on application security, compliance, and emerging threats
IncidentIn 2024, the TeamPCP threat group executed a supply chain attack compromising 170 npm and PyPI packages, including key dependencies like the TanStack Router ecosystem and Mistral AI SDK. The attack ex
IncidentThe Emerging Threat This isn t a traditional incident analysis because there isn t a specific breach to dissect. Instead, a new pattern is emerging in threat intelligence: adversaries are using large
IncidentWhat Happened In early 2025, security researchers at Knostic discovered 1,862 Model Context Protocol (MCP) servers exposed to the public internet without any authentication controls. These servers all
DeadlinesYour AI coding assistant just committed a database connection string to a public repository. The credentials were valid for 47 minutes before your monitoring caught it. During that time, an attacker a
Get weekly security insights and compliance updates delivered to your inbox.
IncidentGoogle s Threat Intelligence Group has disclosed a new threat your security program wasn t designed to handle: a working exploit developed entirely by AI. This vulnerability—a 2FA bypass implemented i
GeneralThe belief that AI-powered security tools will transform your software development lifecycle is widespread. Vendors promise AI-driven vulnerability detection, automated threat modeling, and intelligen
GeneralScope This guide addresses the security and governance challenges when your engineering team uses AI-assisted coding tools. You ll find specific verification practices, governance controls, and refere
IncidentGoogle s Threat Intelligence Group has documented a zero-day exploit that shows signs of AI-assisted development. This exploit was deployed by a criminal group against a popular open-source web-based
IncidentOn May 9, 2026, Checkmarx published a malicious version of its Jenkins AST plugin to the public Jenkins plugin repository. This compromised version was designed to exfiltrate user credentials and pote
IncidentWhat Happened Cyera disclosed a critical heap out-of-bounds read vulnerability in Ollama, a popular open-source framework for running large language models locally. The flaw, tracked as CVE-2026-7482
GeneralThe SolarWinds breach affected over 18,000 customer companies because attackers inserted malicious code during the build process. Your static and dynamic testing tools are the controls that prevent th
GeneralYou ve probably heard the warnings: AI code generators are security nightmares waiting to happen. Your developers are using Cursor or similar tools to generate entire functions in seconds, and suddenl
GeneralScope - What This Guide Covers This guide focuses on data integrity controls for AI systems that inform business decisions. You ll find governance frameworks, implementation steps, and controls to pre
IncidentWhat Happened Intruder s security team scanned over 1 million exposed AI services across the public internet, uncovering widespread security failures in AI infrastructure. The scan revealed that 31% o
GeneralWhen the Linux Foundation adopted the Model Context Protocol (MCP) under the newly formed Agentic AI Foundation in late 2025, your security channels likely buzzed with speculation. Some teams dismisse
IncidentSummary of the Incident Between late February and early March 2026, attackers published five malicious Rust crates to crates.io disguised as time utility libraries. These packages executed code during
