Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams702 Security Engineers759 Compliance Teams223 DevOps Leaders63 Developers31 CISOs17 IT Directors2

Topics:All702 Incident707 General188 Standards88 Research61 Guides34 Deadlines11 Vendor News4 Legal2

702 articles in Incident · Clear filtersSort byNewest·Trending

AI Agents Tricked Into Running Malware They Were Meant to Catch

Incident

Latest

4 min read

AI Agents Tricked Into Running Malware They Were Meant to Catch

Your security tooling just became an attack vector. Researchers have demonstrated a proof-of-concept attack called Friendly Fire that turns AI coding agents into unwitting accomplices. Tools like Anth

For Security EngineersRead article

AI Agent Leaked Private Repos Through a GitHub Issue

Incident

4 min read

AI Agent Leaked Private Repos Through a GitHub Issue

What Happened Noma Security discovered GitLost, a prompt injection attack exploiting GitHub s preview Agentic Workflows to leak private repository data. The attack is simple: an attacker submits a cra

For Security EngineersRead

ColdFusion RDS Zero-Day: Exploited in Two Hours

Incident

4 min read

ColdFusion RDS Zero-Day: Exploited in Two Hours

What Happened On June 30, 2026, Adobe released emergency patches for CVE-2026-48282, a path traversal vulnerability in ColdFusion s Remote Development Services (RDS) component. This vulnerability has

For Security EngineersRead

NIST Application Security Framework: What Went Wrong Before SSDF 1.1

Incident

5 min read

NIST Application Security Framework: What Went Wrong Before SSDF 1.1

Thousands of organizations have been shipping vulnerable software, treating security as a post-development checkbox rather than an integrated practice. NIST SP 800-218 Version 1.1 was developed becaus

For DevOps LeadersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

654 Repos Passed Security Scans While Leaking Secrets

Incident

5 min read

654 Repos Passed Security Scans While Leaking Secrets

Your GitHub Actions workflows are green across the board. CodeQL found nothing. Your SAST tool gave you a clean bill of health. You re compliant, right? Not according to Novee Security, which just fla

For Security EngineersRead

7 Days to Exploit: Adobe ColdFusion CVE-2026-48282

Incident

4 min read

7 Days to Exploit: Adobe ColdFusion CVE-2026-48282

What Happened Between June 3 and June 10, federal agencies had just seven days to patch CVE-2026-48282, a critical remote code execution vulnerability in Adobe ColdFusion. Adobe released the security

For Compliance TeamsRead

GitHub's GitLost: When AI Agents Leak Private Repos

Incident

4 min read

GitHub's GitLost: When AI Agents Leak Private Repos

A public GitHub issue with a cleverly-worded sentence can trick an AI agent into revealing the contents of your private repository. This isn t just theoretical. Researchers at Noma Security demonstrat

For Security EngineersRead

Incident

5 min read

AI Agent Wrote the Vulnerable Code: A Supply Chain Incident You Can't Patch Traditionally

What Happened Your team integrated an AI coding assistant into the CI/CD pipeline to speed up feature delivery. Over three months, the assistant generated about 40% of the production code, including a

For Security EngineersRead

Rogue Agent: When Edit Rights Became Runtime Access

Incident

5 min read

Rogue Agent: When Edit Rights Became Runtime Access

A single permission in Google Dialogflow CX could have let an attacker with edit rights on one chatbot agent compromise every other agent in the same Google Cloud project. Varonis discovered the flaw,

For Security EngineersRead

CISA's Latest KEV Additions: 48 Hours to Patch

Incident

4 min read

CISA's Latest KEV Additions: 48 Hours to Patch

On a Tuesday morning, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog. By Wednesday afternoon, security teams were dealing with active exploitation attempts. This was th

For Security EngineersRead

Gitea Header Injection: 13 Days to Exploitation

Incident

4 min read

Gitea Header Injection: 13 Days to Exploitation

On January 17, 2025, Gitea maintainers disclosed CVE-2026-20896, a critical authentication bypass in their Docker images. This flaw allows anyone to send a crafted HTTP header and gain admin access to

For DevOps LeadersRead

Incident

4 min read

ColdFusion Exploit Caught in Two Hours

On the same day Adobe disclosed CVE-2026-48282 , a critical vulnerability in ColdFusion, attackers were already probing for vulnerable servers. KEVIntel s honeypots captured exploitation attempts with

For Security EngineersRead

Incident

4 min read

The Log4Shell Fix That Never Arrived

In December 2021, your team scrambled to patch Log4Shell. You identified every instance of the vulnerable Log4j library, applied updates, and documented the remediation. Three months later, a routine

For Security EngineersRead

Incident

5 min read

Type System Ignored, IDOR Shipped

A development team deployed a customer dashboard that let authenticated users view any account by changing a URL parameter. The vulnerability sat in production for three months before a penetration te

For Security EngineersRead

When Attack Path Validation Failed: A Platform Migration Story

Incident

4 min read

When Attack Path Validation Failed: A Platform Migration Story

What Happened A financial services company with 2,800 employees spent 18 months feeding vulnerability data into their exposure management platform. Their dashboard showed 847 critical findings. The se

For Security EngineersRead

Capital One's AI Red Team Doubled Their Attack Success Rate

Incident

4 min read

Capital One's AI Red Team Doubled Their Attack Success Rate

What Happened Capital One s AI Foundations group developed a reinforcement learning system to identify effective jailbreak techniques against large language models. They tested it using the WildJailbr

For Security EngineersRead

Showing 113-128 of 702 articles

PreviousPage 8 of 44Next