Expert perspectives on application security, compliance, and emerging threats
DeadlinesYour company probably isn t ready for the Cyber Resilience Act (CRA). According to recent research, 66% of the global software community hasn t heard of the CRA, with North American teams hitting 72%
IncidentWhat Happened OX Security discovered 24 npm packages containing malicious HTML pages designed to impersonate Cloudflare s security verification interface. The attack didn t target developers machines
GeneralThe conversation about AI coding agents often misses the real issue. Teams debate CLI versus IDE, agentic versus copilot, autonomous versus assisted. The actual risk is clear: you re generating code f
IncidentWhat Happened Researchers from Shanghai Jiao Tong University and Ant Group have demonstrated a new attack vector called InjecMEM. This attack compromises AI agent memory systems through normal user in
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened On January 21, 2026, Oracle released patches for CVE-2026-21962 , a vulnerability in WebLogic Server with a perfect 10.0 CVSS score. This flaw allows attackers to access and modify criti
StandardsThe Second NIST Cyber AI Profile Workshop highlighted a key issue in AI governance: the disconnect between enterprise-level policy and the engineers tasked with implementation. The Challenge NIST s Pr
IncidentWhat Happened Phantom Raven is an active AI-native supply chain attack targeting developer environments through compromised open-source packages. This campaign exploits the basic developer workflow: p
GeneralYour team just got asked to support AI agents that use Model Context Protocol (MCP). You ve got hundreds of existing APIs. Now what? This guide walks through the technical decisions you ll face when i
ResearchYou ve likely seen the pitch: AI will transform your vulnerability management, speed up triage, and catch threats before humans can. What vendors don t mention is that adding AI to a flawed security m
IncidentWhat Happened A mid-sized financial services company deployed an AI-powered vulnerability scanning tool in July to support their SOC 2 Type II recertification. The tool integrated with their CI/CD pip
ResearchWhen you deploy an AI bot into production, you re making an implicit promise about where the security boundary lies. Does each bot instance run with unique credentials? Does a compromise affect one us
ResearchUnderstanding the AI Usage Disparity Akamai s State of the Internet: Enterprise AI Usage Risk Report 2026 highlights a critical issue: the top 5% of AI users in your organization engage with AI models
IncidentWhat Happened South Korea s Modu-ui Changup platform, run by the Ministry of SMEs and Startups, leaked personal information and startup business ideas for about 5,000 applicants. The cause was an encr
IncidentThe Problem A security team at a financial services company ran static analysis tools and found 847 vulnerabilities in their codebase. Their reachability scanner confirmed 312 of these could execute.
ResearchAbout six months ago, questions started popping up in our Slack channel. An engineer asked about ChatGPT usage policies. Another wondered how to scan AI-generated pull requests. Recently, a compliance
GuidesYour developers are using ChatGPT to debug code. Marketing is running campaign copy through Claude. Support is testing AI chatbots you didn t approve. According to Gartner analyst Andrew Walls, every
