Expert perspectives on application security, compliance, and emerging threats
IncidentOn August 25, 2026, Oasis Security revealed a vulnerability in NVIDIA NemoClaw that allows a webpage controlled by an attacker to take over a local Ollama instance on your machine. Although no exploit
IncidentWhat Happened NVIDIA s OpenClaw tool had a vulnerability allowing attackers to access the local model server without authentication via the Ollama API. This flaw enabled ongoing corruption of AI agent
IncidentTwo critical vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin allowed attackers to access WordPress admin panels without credentials. Although both flaws are now patched, exploitation
IncidentA security flaw in Marimo s Python notebook software allowed attackers to execute arbitrary Model Context Protocol (MCP) commands before any cell code ran. The vulnerability, tracked as CVE-2026-75149
Get weekly security insights and compliance updates delivered to your inbox.
IncidentYour Gitea instance just served cryptojacking malware to an attacker who never should have had access. This isn t hypothetical. CVE-2026-60004, a remote code execution vulnerability with a CVSS score
IncidentWhat Happened OX Security discovered 24 npm packages containing malicious HTML pages designed to impersonate Cloudflare s security verification interface. The attack didn t target developers machines
IncidentWhat Happened Researchers from Shanghai Jiao Tong University and Ant Group have demonstrated a new attack vector called InjecMEM. This attack compromises AI agent memory systems through normal user in
IncidentWhat Happened On January 21, 2026, Oracle released patches for CVE-2026-21962 , a vulnerability in WebLogic Server with a perfect 10.0 CVSS score. This flaw allows attackers to access and modify criti
IncidentWhat Happened Phantom Raven is an active AI-native supply chain attack targeting developer environments through compromised open-source packages. This campaign exploits the basic developer workflow: p
IncidentWhat Happened A mid-sized financial services company deployed an AI-powered vulnerability scanning tool in July to support their SOC 2 Type II recertification. The tool integrated with their CI/CD pip
IncidentWhat Happened South Korea s Modu-ui Changup platform, run by the Ministry of SMEs and Startups, leaked personal information and startup business ideas for about 5,000 applicants. The cause was an encr
IncidentThe Problem A security team at a financial services company ran static analysis tools and found 847 vulnerabilities in their codebase. Their reachability scanner confirmed 312 of these could execute.
IncidentWhat Happened Novee s security research team discovered a vulnerability in Cursor, an AI-powered code editor, that allowed full remote code execution on a developer s workstation. The flaw exploited t
IncidentNearly one in three organizations experienced an API breach in the past 12 months. If you re assuming your WAF caught everything, you re using the wrong security model. What Happened Organizations rel
IncidentThe Problem In 2025, nearly one-third of known exploited vulnerabilities were exploited on or before the day they were publicly disclosed. This isn t an isolated incident, it s a widespread issue affe
IncidentWhat Happened A customer-facing LLM chatbot bypassed its safety guardrails when a user submitted input that overrode the system s original instructions. The bot disclosed internal prompts, leaked cust
