Expert perspectives on application security, compliance, and emerging threats
IncidentSAP s July 2026 security update included CVE-2026-44747 , an out-of-bounds write vulnerability in NetWeaver Application Server ABAP with a CVSS score of 9.9. This flaw allows an authenticated attacker
IncidentWhat Happened Between May and July 2026, attackers exploited CVE-2026-46817 , a critical Oracle E-Business Suite vulnerability that allows unauthenticated remote code execution. Oracle released a patc
IncidentWhat Happened OpenAI used GPT-Red, an automated adversarial testing system, to identify prompt injection vulnerabilities in GPT-5.6 Sol before its release. The testing showed that earlier versions wer
IncidentWhen the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published new guidance on coordinated vulnerability disclosure programs in late 2024, it admitted its own reporting channels had f
Get weekly security insights and compliance updates delivered to your inbox.
IncidentIn December 2024, researchers at Seoul National University demonstrated a new attack that made AI agents perform unintended actions. This attack succeeded up to 50% of the time against current defense
IncidentWhat Happened Anthropic s Claude for Chrome extension has two vulnerabilities that allow malicious browser extensions to hijack the AI s capabilities to read and exfiltrate user data. Security researc
IncidentWhat Happened Progress Software discovered a zero-day vulnerability in ShareFile Storage Zone Controllers and made an unusual decision: release patches immediately but delay the CVE publication for tw
GeneralYou clone a repository, open it in your editor, and malicious code executes before you ve reviewed a single line. This isn t a theoretical attack; it s how untrusted search path vulnerabilities work i
ResearchLast week, security researchers found that an attacker published malicious npm packages to the official @asyncapi namespace without stealing any credentials. They hijacked the project s GitHub Actions
IncidentOn July 14, a misconfigured GitHub Actions workflow turned AsyncAPI s npm packages into a distribution channel for credential-stealing malware. The attack lasted just over four hours, but the packages
ResearchRethinking Vulnerability Disclosure Many security teams treat vulnerability disclosure as a mere compliance task. You might post a security.txt file, set up a [email protected] email that routes to
GeneralYou ve filled out the framework mapping spreadsheet. You ve documented your model card. You ve assigned risk tiers to your AI systems. And now you think you re done with AI governance. Here s the prob
IncidentIntruder s security research team discovered a SQL injection vulnerability in the Creative Mail plugin for WordPress using an automated pipeline that combines traditional code scanning with AI analysi
IncidentCISA issued Emergency Directive 25-01 on January 15, 2025, ordering federal agencies to patch or mitigate two remote code execution vulnerabilities in Joomla extensions within 72 hours. The flaws in i
GeneralMany believe you can secure AI models just like software artifacts. Sign them with the same tools, scan them with the same scanners, and apply the same supply chain controls you use for container imag
IncidentWhat Happened SAP released 16 security patches in July 2026, including three critical vulnerabilities that could let attackers access unauthorized data, crash systems, or trigger denial-of-service con
