Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened Researchers demonstrated a successful promptware attack against Google s AI systems using a simple calendar invitation. The attack began when an AI agent processed a malicious Google Cal
ResearchYou re facing a potential insecure deserialization vulnerability in a web application. Crafting a proof-of-concept (PoC) usually involves tedious documentation review and payload crafting. What if you
GeneralSecurity teams often cling to outdated assumptions about static analysis customization. These assumptions made sense when development was slower and codebases were stable. However, with AI coding assi
GeneralScope - What This Guide Covers This guide focuses on how your platform engineering team can integrate supply chain security controls into shared infrastructure while minimizing disruption for applicat
Get weekly security insights and compliance updates delivered to your inbox.
GuidesThe Question at Hand React2Shell landed with two CVEs (CVE-2025-55182 and CVE-2025-66478), both scoring a perfect 10.0 on CVSS. Within days, PortSwigger added detection capabilities into Burp Suite s
IncidentPersistent Vulnerabilities Log4j vulnerabilities continue to surface in security assessments across production environments in 2024, despite the CVE-2021-44228 disclosure in December 2021. Your team m
ResearchYour security scanners flag hundreds of findings per pull request. Your developers ignore most of them. Meanwhile, AI code assistants generate more code than your team can manually review. You need a
GeneralYour developers are shipping code faster than ever, thanks to AI coding assistants. However, if you re still using the same security tools from three years ago, you re accumulating risk faster than yo
IncidentThe Problem A mid-sized fintech company s security team spent three weeks triaging 847 vulnerabilities flagged by their static analysis tool during a pre-release audit. After manual investigation, the
StandardsWhat Changed GitHub s Secure Open Source Fund (SOSF) has added two Software Bill of Materials (SBOM) generators to its portfolio: cdxgen and CycloneDX .NET. These projects now receive funding, securit
StandardsYou ve probably already experimented with Claude or GPT-4 for code review. Maybe you ve been impressed by how quickly these models spot obvious SQL injection patterns or flag hardcoded credentials. Th
GuidesYour security team finds vulnerabilities. Developers fix them three sprints later. Finance sees security tooling as pure overhead. This cycle burns budget and slows delivery. The solution is not anoth
StandardsThe Challenge Your security team faces a new measurement problem: you can t quantify what you re protecting. According to Checkmarx s Future of AppSec Report, nearly half of organizations don t know w
IncidentThe Problem A mid-sized financial services company found a critical authentication bypass vulnerability in their customer portal during a routine scan. The vulnerability management team logged it, ass
StandardsThe Problem: Why AI Governance Matters Now AI adoption in your security organization has surged from 50% to 75% in just one year. Your team is now managing AI-driven vulnerability scanners, code analy
IncidentWhat Happened In August 2023, HashiCorp transitioned Vault from the Mozilla Public License to the Business Source License (B.S.L.). This change didn t cause a data breach, but it revealed a critical i
