Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened Anthropic s Claude for Chrome extension has two vulnerabilities that allow malicious browser extensions to hijack the AI s capabilities to read and exfiltrate user data. Security researc
IncidentWhat Happened Progress Software discovered a zero-day vulnerability in ShareFile Storage Zone Controllers and made an unusual decision: release patches immediately but delay the CVE publication for tw
GeneralYou clone a repository, open it in your editor, and malicious code executes before you ve reviewed a single line. This isn t a theoretical attack; it s how untrusted search path vulnerabilities work i
ResearchLast week, security researchers found that an attacker published malicious npm packages to the official @asyncapi namespace without stealing any credentials. They hijacked the project s GitHub Actions
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn July 14, a misconfigured GitHub Actions workflow turned AsyncAPI s npm packages into a distribution channel for credential-stealing malware. The attack lasted just over four hours, but the packages
ResearchRethinking Vulnerability Disclosure Many security teams treat vulnerability disclosure as a mere compliance task. You might post a security.txt file, set up a [email protected] email that routes to
GeneralYou ve filled out the framework mapping spreadsheet. You ve documented your model card. You ve assigned risk tiers to your AI systems. And now you think you re done with AI governance. Here s the prob
IncidentIntruder s security research team discovered a SQL injection vulnerability in the Creative Mail plugin for WordPress using an automated pipeline that combines traditional code scanning with AI analysi
IncidentCISA issued Emergency Directive 25-01 on January 15, 2025, ordering federal agencies to patch or mitigate two remote code execution vulnerabilities in Joomla extensions within 72 hours. The flaws in i
GeneralMany believe you can secure AI models just like software artifacts. Sign them with the same tools, scan them with the same scanners, and apply the same supply chain controls you use for container imag
IncidentWhat Happened SAP released 16 security patches in July 2026, including three critical vulnerabilities that could let attackers access unauthorized data, crash systems, or trigger denial-of-service con
IncidentWhat Happened Maven Central is tackling a coordination problem. A vulnerability appears in a widely-used library, but the maintainer is unavailable, unresponsive, or has abandoned the project. Your bu
IncidentWhat Happened Tracebit researchers conducted an experiment that should concern anyone developing AI-powered security tools. They deployed autonomous AI agents in test environments to see how quickly t
IncidentOn a typical Tuesday, a widely-used JavaScript protection tool became an attack vector. The Jscrambler npm package , trusted by development teams for code obfuscation and security, was compromised wit
IncidentWhat Happened In December 2024, security researchers disclosed a vulnerability in Cursor, an AI-powered code editor, that allows automatic execution of malicious code when a developer opens a compromi
ResearchYour team just adopted an AI coding assistant. You ve reviewed the privacy settings, turned off model training, and assumed you re protected. Meanwhile, the tool is uploading your entire Git history t
