Expert perspectives on application security, compliance, and emerging threats
IncidentA vulnerability researcher discovered that Salesforce and ServiceNow portals remained exposed for 17 months before detection. During that time, attackers exploited a Metabase zero-day to access custom
IncidentYour vendor management program looked solid on paper. You had a questionnaire, reviewed SOC 2 reports annually, and checked the compliance boxes. Then a third-party incident hit, and you re facing a $
IncidentWhat Happened During DARPA s Artificial Intelligence Cyber Challenge (AIxCC), Team Atlanta deployed OSS-CRS, an AI-driven system designed to automatically detect and patch vulnerabilities in open sour
IncidentWhat Happened A mid-market organization tracked 847 vulnerabilities across their environment. Over three months, they reduced this number to 623. The security team celebrated the progress. However, an
Get weekly security insights and compliance updates delivered to your inbox.
IncidentThe Breach Overview A financial services organization faced a major security breach when a single stolen credential led to domain-wide access. The initial entry point seemed minor: one set of credenti
IncidentYou deployed a fix for Log4Shell in December 2021. Your scanners showed clean. Three months later, an attacker used the same vulnerability to compromise a legacy microservice you forgot was still runn
IncidentOn a Tuesday, SAP released patches for CVE-2026-58231, a remote code execution vulnerability in Commerce Cloud with a CVSS score of 10.0. By Friday, threat intelligence firm Defused confirmed active e
IncidentIn February 2024, JFrog researchers discovered a weaponized PyTorch model on Hugging Face that opened a reverse shell on any system that loaded it. The model sat in a public repository, unsigned and u
IncidentWhat Happened On December 18, 2024, a zero-day SQL injection vulnerability in GeoServer s jsonArrayContains function was publicly disclosed on social media. This flaw lets unauthenticated attackers in
IncidentWhat Happened The Axios npm package, downloaded 100 million times weekly, was compromised with a backdoor. The attack deployed WAVESHAPER.V2, a remote access trojan that exfiltrated developer secrets
IncidentThe Problem A security team recently completed a major remediation effort, closing 251 vulnerability tickets across their application portfolio. They achieved 98% patch compliance, and the dashboard s
IncidentOn January 14, 2025, Rapid7 Labs disclosed a critical exploit chain targeting Microsoft SharePoint Server. The chain combines CVE-2026-55040 (CVSS 9.1, JWT authentication bypass) and CVE-2026-63520 (r
IncidentOn October 13, 2026, the deadline for NIST s Request for Information (RFI) will close. If your team hasn t submitted feedback yet, you re missing a key opportunity to influence the future of vulnerabi
IncidentOn December 20, 2024, developers installing LiteLLM versions 1.82.7 or 1.82.8 from PyPI unknowingly turned their workstations into credential extraction engines. The TeamPCP threat actor had compromis
IncidentA vulnerability in libpng went undetected for three decades before it was patched in February 2026. Similarly, Windows PrintDemon lingered in production code for 24 years before Microsoft addressed it
IncidentWhat Happened CVE-2026-71362 allows attackers to hijack customer accounts on Adobe Commerce and Magento platforms without authentication. Adobe released patches for this vulnerability along with fixes
