Expert perspectives on application security, compliance, and emerging threats
StandardsThe release candidate of ASVS 5.0 was announced on April 9, 2025. You have a limited opportunity to influence what becomes the benchmark for application security verification. Elar Lang will present t
IncidentWhat Happened On February 17, 2026, an attacker exploited a compromised npm publish token to release Cline CLI version 2.3.0, an unauthorized update that installed OpenClaw on developer systems. This
IncidentThe Problem: Widespread Vulnerabilities According to Datadog s State of DevSecOps 2026 report, 87% of organizations are running at least one exploitable vulnerability in their production services. The
IncidentOverview of the Incident On February 6, n8n released version 2.6.4 to address a stored cross-site scripting (XSS) vulnerability in its handling of OAuth credentials. Security researchers at Imperva fo
Get weekly security insights and compliance updates delivered to your inbox.
IncidentYour security team invested in threat intelligence feeds, built a threat modeling framework, and ran quarterly vulnerability assessments. Yet, an adversary exploited a gap you d documented but never v
StandardsScope This guide focuses on detecting and preventing adaptive malware that uses AI to modify itself within software supply chains. It includes specific controls for npm ecosystems, integrity verificat
IncidentWhat Happened OpenClaw , an AI-powered development tool widely adopted by developers, recently disclosed and patched a critical vulnerability. This flaw was present in a tool actively integrated into
GeneralAfter the XZ Utils backdoor discovery in 2024—where a compromised compression utility could have granted attackers full administrative control over millions of systems—your compliance team probably ad
GeneralScope - What This Guide Covers This guide addresses the security implications of AI-powered development assistants that execute code directly on developer workstations. It focuses on: Prompt injection
IncidentWhat Happened In late 2024, Truffle Security discovered 2,863 live Google Cloud API keys exposed in public repositories. These weren t stolen credentials or phishing victims—they were legitimate billi
StandardsThe security profile of API keys has shifted dramatically. Researchers at TruffleHog discovered over 2,800 live Google API keys publicly exposed in code repositories—keys that now grant access to Goog
StandardsIf your organization is deploying federated learning systems, you re already dealing with a core privacy challenge: training models on distributed data without centralizing that data. But protecting t
StandardsScope - What This Guide Covers This guide focuses on implementing security for React Native applications using resources from the OWASP Mobile Application Security (MAS) project. It provides specific
StandardsYour IAM system was designed for humans and services with predictable behavior. AI agents break that model. According to a 2025 SailPoint survey, 80% of organizations using AI agents have observed the
StandardsConfluent s February 26 announcement of Agent2Agent (A2A) protocol support, multivariate anomaly detection, and Queues for Kafka (KIP-932) marks a significant shift in how you need to architect event
GeneralThe conventional wisdom : When AI coding agents don t boost productivity, teams often think they need a smarter model. They consider waiting for GPT-5, switching to Claude Opus, or fine-tuning on prop
