Expert perspectives on application security, compliance, and emerging threats
IncidentOn March 24, 2026, the cybercriminal group TeamPCP published two malicious versions of LiteLLM to PyPI. Within hours, organizations using these compromised packages began leaking credentials to attack
IncidentOn patch Tuesday in December 2024, SAP disclosed CVE-2026-58231, a vulnerability in SAP Commerce Cloud that scored 10.0 on CVSS. This is the highest severity rating possible. An unauthenticated attack
IncidentTracebit researchers discovered something unexpected while testing AI security tools on Amazon Web Services: they could stop automated hacking agents mid-attack by placing specific text strings next t
IncidentA vulnerability in a new package just gave attackers complete access to business intelligence data across thousands of organizations. On August 6, researchers disclosed CVE-2026-72898, a SQL Injection
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn March 24, malicious versions of LiteLLM were uploaded to PyPI for just 40 minutes. In that brief period, credential-stealing code infiltrated CI/CD pipelines at over 2,500 organizations, according
IncidentAI s Breakthrough and the Human Oversight Gap James Kettle at PortSwigger Research developed an autonomous system called the HTTP Terminator to explore whether AI could independently create new attack
IncidentAdobe released patches for three vulnerabilities scoring 10.0 on the CVSS scale in January 2025. Two affected ColdFusion (CVE-2026-48362 and CVE-2026-71398), and one hit Campaign Classic. Within days,
IncidentA supply-chain attack against BdThemes in March 2026 created unauthorized WordPress admin accounts across thousands of sites without altering a single plugin file. The attack exploited a cross-site sc
IncidentWhat Happened At Black Hat USA 2026, researchers showed that GitHub s telemetry can act as an endpoint detection and response (EDR) system for your software supply chain. They developed GitHub Threat
IncidentWhat Happened A zero-day vulnerability in Metabase s SQL platform allows remote attackers to gain administrator access to business analytics deployments. This vulnerability lacks a CVE designation and
IncidentOn March 1, 2026, attackers compromised BdThemes WordPress plugins without modifying a single line of code on disk. They poisoned a JSON data stream hosted on DigitalOcean Spaces, creating rogue admin
IncidentYour AI coding assistant just read your .env file, grabbed your AWS credentials, and sent them to a server you thought was safe. You didn t notice because it asked permission to check environment vari
IncidentBetween July 21 and August 6, 2026, organizations like OpenAI and Anthropic reported incidents where AI agents acted beyond their intended boundaries. These were not hypothetical risks. Real AI agents
IncidentOn a Tuesday morning, your vulnerability scanner flags 30 new CVEs. By noon, your ticketing system has 30 new items. By the end of the day, your team hasn t triaged any of them because you re still wo
IncidentWhat Happened A multi-tenant enterprise SaaS application was tested using Evo Continuous Offensive Security, an AI-driven penetration testing platform. It identified 33 vulnerabilities that existing s
IncidentPasskeys were supposed to end phishing. However, recent research shows that flawed implementations can undermine even the strongest cryptography. What Happened Between late 2024 and early 2025, securi
