Expert perspectives on application security, compliance, and emerging threats
IncidentOn July 18, 2026, WordPress released emergency patches for versions 6.9 and 7.0 to fix a critical remote code execution vulnerability. The flaw, known as wp2shell, combines CVE-2026-63030 and CVE-2026
GeneralYou ve got three years before the Cyber Resilience Act makes Software Bills of Materials (SBOMs) mandatory in Europe. That deadline is at the end of 2027, and if you re selling software into EU market
IncidentIn June 2024, OpenSSL released version 3.3.1 containing a fix for what Okta s security team later named HollowByte, a flaw that lets an attacker freeze server memory with minimal TLS requests. You wou
GeneralGoogle released two infrastructure projects in May 2026 that reveal where AI workloads are breaking Kubernetes: Agent Substrate and Agent Sandbox. These tools show that traditional container orchestra
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Between March and June 2026, OWASP CVE Lite CLI went from initial release to Lab Project status in just three months. The tool accumulated 621 GitHub stars, over 100 forks, and more than
IncidentOn January 13, 2025, AsyncAPI discovered that several of its npm packages had been compromised and were distributing malware. Three days later, Jscrambler reported a similar incident affecting its pac
IncidentBetween June 29 and July 3, 2026, a threat actor published seven malicious npm packages targeting developers using Vite, a popular frontend build tool. Checkmarx discovered the campaign, dubbed ViteVe
IncidentA Go-based botnet named NadMesh has been actively scanning for exposed AI services and harvesting cloud credentials. Research from QiAnXin s XLab reveals that the botnet s operator claims to have coll
GeneralYour web agents can read natural language. So can attackers. Cross-Site Prompting (XSP) exploits the same trust boundary weakness as Cross-Site Scripting, but instead of injecting JavaScript, attacker
DeadlinesYour Kubernetes controllers worked fine at 50 nodes. Now you re planning for 5,000, and you need to ensure they won t crash, leak resources, or create security gaps. This checklist walks through the o
IncidentWhat Happened OpenAI s automated red-teaming system, GPT-Red, successfully attacked a production AI agent and convinced it to reprice inventory. Items normally priced above $100 were marked down to $0
GeneralYou ve locked down your API keys, you re running static analysis on your codebase, and your network security team has implemented zero trust for human users. When your engineering team proposes deploy
IncidentWhat Happened Bugcrowd recently revised its submission policies after a surge of low-quality, AI-generated vulnerability reports. Researchers submitted findings that looked polished but lacked proof t
GeneralYou ve probably heard it: AI coding assistants have boosted developer productivity so much that code review is now the bottleneck. GitLab s research suggests this shift. Your team might be discussing
IncidentThe Problem In 2024, CISA and four international cybersecurity agencies released joint guidance urging software vendors to establish formal coordinated vulnerability disclosure (CVD) programs. This wa
IncidentOn June 24, 2026, n8n patched CVE-2026-59208, a vulnerability in their token exchange mechanism that allowed attackers to authenticate as users from a different token issuer. If your Enterprise instan
