Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened Between January and December 2024, software development teams using AI-assisted coding tools saw a significant shift. They reduced their median vulnerability age by 59%. Teams triaged fa
IncidentWhat Happened Google s Mandiant used an AI-driven tool called the Agentic Vulnerability Discovery Harness (AVDH) to scan production codebases. In just two days, it found over 100 verified, high-severi
IncidentYour MLflow instances are leaking cloud credentials right now. Attackers aren t waiting for you to patch CVE-2026-64849. They re already inside, targeting the metadata endpoints that hand over AWS key
IncidentA crafted URL could silently execute prompts in Microsoft Copilot Personal and exfiltrate data from any connected application, no user interaction required beyond clicking a link. Varonis Threat Labs
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn a Tuesday morning, an unauthenticated attacker could walk into any public GitLab project and delete it. No credentials. No social engineering. Just a critical code injection vulnerability and an HT
IncidentA zero-click remote code execution vulnerability in GitLab s self-managed instances highlights a critical gap in how your team prepares for urgent patches. When you can t detect exploitation and have
IncidentWhat Happened In January 2025, GitLab disclosed a critical vulnerability (CVE-2026-19478) that allowed unauthenticated attackers to modify or delete public repositories with a single HTTP request. Thi
IncidentThe Issue at Hand Between 2023 and 2024, organizations using AI code generation noticed a troubling trend: the same AI models that excel at finding vulnerabilities were also introducing security flaws
IncidentIn December 2020, security teams discovered that attackers had compromised SolarWinds Orion platform and distributed malicious updates to roughly 18,000 customers. The breach went undetected for month
IncidentWhat Happened On June 23, 2026, Wiz disclosed a command injection vulnerability in Snowflake s public GitHub repository. This flaw allowed attackers to execute arbitrary commands through crafted GitHu
IncidentOn December 11, 2024, SAP released patches for CVE-2026-58231, a vulnerability in SAP Commerce Cloud with a CVSS score of 10.0. By December 14, attackers were already probing exposed instances. If you
IncidentOn a Tuesday outside GitLab s normal patch cycle, security teams running self-managed instances faced a choice: patch immediately or risk losing public projects to unauthenticated attackers. CVE-2026-
IncidentOn August 12, 2026, researcher @q1uf3ng disclosed a critical SQL injection vulnerability in GeoServer that enables remote code execution. Within hours, watchTowr detected active exploitation attempts.
IncidentOn July 31, 2026, WPMU DEV released version 1.56.2 of Forminator Forms to patch CVE-2026-15748, a vulnerability rated 9.8 on CVSS v3. This flaw allowed unauthenticated attackers to upload and execute
IncidentWhat Happened Your security team might run regular penetration tests on your infrastructure and network, but what about your web applications? In this case, a team conducted quarterly tests on their i
IncidentBetween January and December 2025, the CVE Program disclosed 48,174 new vulnerabilities. That s 131 per day. Your team can t patch 131 things daily. Nobody can. The real problem isn t the volume. It s
