Expert perspectives on application security, compliance, and emerging threats
ResearchThe Challenge The European Union s draft of the Cyber Resilience Act (CRA) initially treated open source software like commercial products, imposing liability on community maintainers—volunteers often
StandardsSocket disclosed the SANDWORM_MODE campaign this week: at least 19 malicious npm packages designed to harvest credentials, cryptocurrency keys, and API tokens from developer environments. The attack i
IncidentWhat Happened A threat actor compromised the Cline CLI package on npm and modified it to silently install OpenClaw—an AI coding agent—on developer machines without consent. The malicious version was l
GeneralYour security team is about to add a new specialization. Not because of a compliance mandate or a framework update—because AI systems break every assumption traditional security roles are built on. At
Get weekly security insights and compliance updates delivered to your inbox.
StandardsThe Challenge Your compliance team faces a recurring problem: Python developers move fast, while security teams move carefully, creating a risk gap. When uv emerged as a high-performance Python packag
GuidesWhy This Matters Your application needs to integrate with third-party services like Google Workspace, Salesforce, and GitHub without collecting and storing user passwords. You ve heard just use OAuth,
IncidentWhat Happened Your development team deployed an internal LLM service with an exposed API endpoint for rapid prototyping. The endpoint used a hardcoded API key with broad permissions to access the orga
IncidentOn a Tuesday morning, developers running npm update unknowingly downloaded [email protected] — an unauthorized release published without human approval. The package remained live for eight hours, during whi
IncidentWhat Happened Researchers demonstrated a successful promptware attack against Google s AI systems using a simple calendar invitation. The attack began when an AI agent processed a malicious Google Cal
ResearchYou re facing a potential insecure deserialization vulnerability in a web application. Crafting a proof-of-concept (PoC) usually involves tedious documentation review and payload crafting. What if you
GeneralSecurity teams often cling to outdated assumptions about static analysis customization. These assumptions made sense when development was slower and codebases were stable. However, with AI coding assi
GeneralScope - What This Guide Covers This guide focuses on how your platform engineering team can integrate supply chain security controls into shared infrastructure while minimizing disruption for applicat
GuidesThe Question at Hand React2Shell landed with two CVEs (CVE-2025-55182 and CVE-2025-66478), both scoring a perfect 10.0 on CVSS. Within days, PortSwigger added detection capabilities into Burp Suite s
IncidentPersistent Vulnerabilities Log4j vulnerabilities continue to surface in security assessments across production environments in 2024, despite the CVE-2021-44228 disclosure in December 2021. Your team m
ResearchYour security scanners flag hundreds of findings per pull request. Your developers ignore most of them. Meanwhile, AI code assistants generate more code than your team can manually review. You need a
GeneralYour developers are shipping code faster than ever, thanks to AI coding assistants. However, if you re still using the same security tools from three years ago, you re accumulating risk faster than yo
