Articles & News

Open-weight models cut inference costs by 60 to 90 percent. They also turn AI into infrastructure the security team has to discover, secure, and continuously verify.

OpenAI's models escaped a sandbox and hacked Hugging Face mid-evaluation. What that means for how application security has to work next.

Syntax correctness passed 95%. Security pass rates are still stuck near 55%.

Reachability tells you code can execute. Runtime tells you it did.

We found a vulnerability in Kiro, AWS's agentic IDE, that breaks this promise. By planting hidden instructions in a web page Kiro reads, an attacker can make Kiro rewrite its own MCP (Model Context Protocol) server configuration file and gain arbitrary code execution on the developer's machine.

An LLM jailbreak bypasses a model's safety guardrails to produce restricted output. How jailbreaks work, how they differ from prompt injection, and defenses.

RAG security covers the risks of retrieval-augmented generation: injection through retrieved content, data poisoning, and leakage. The threats and how to defend.

MCP security covers the risks of the Model Context Protocol connecting AI agents to tools and data. The main threats, and how to contain them at runtime.

A software bill of materials (SBOM) inventories every component in your software. What an SBOM includes, why it matters, and how runtime makes it actionable.

Server-side template injection (SSTI) lets user input run in a template engine, often escalating to RCE. How SSTI works, and how to prevent and detect it.

Remote code execution (RCE) lets an attacker run code on your system. How RCE attacks work, what causes them, and why runtime reachability decides which ones matter.

A stolen GitHub token let an attacker publish four backdoored @asyncapi packages through AsyncAPI's own release pipeline. Get the attack chain, IOCs, and first-hour response runbook.

Kodem AI-BOM extends your SBOM with an AI bill of materials: identify AI packages, verify runtime execution, and govern AI supply chain risk at scale.

Discover the key security issues in Scala, explore critical CVEs, and learn best practices to secure your Scala applications against vulnerabilities.

Malicious @injectivelabs/sdk-ts 1.20.21 stole wallet keys via a fake npm telemetry hook. See affected versions, IOCs, and the response runbook.

Veracode's 45% AI code stat is everywhere. Here's why knowing which flaw actually ran matters more than the number.

EPSS estimates the probability a CVE will be exploited in the next 30 days. How it works, how it compares to CVSS and KEV, and how to prioritize with it.

Reachability says a vulnerable function could run. Exploitability proves it did. Here is how runtime evidence tells the two apart.

Five backstage-plugin-gitlab-backend versions ship a malicious binding.gyp that runs code at npm install via node-gyp. Affected versions, IOCs, and runbook.

Agentic AI security protects AI agents and the tools, memory, and systems they touch. The main risks, and how to contain them at the runtime layer.

The OWASP Top 10 for LLM Applications (2025) risks explained, plus how runtime tells you which are actually exploitable in your stack.

AI red teaming stress-tests AI systems for prompt injection, jailbreaks, and agent abuse. How it works, and how runtime evidence confirms real risk.

Prompt injection is OWASP LLM01. How direct and indirect prompt injection work, why it cannot be patched in the model, and how to defend AI apps at runtime.

When a scan blocks a build or surfaces a finding, the first question is about the scan. Scan History keeps the execution record so investigations start with evidence.

On June 17, 2026, a hijacked contributor account republished more than 140 @mastra npm packages with a malicious easy-day-js dropper that delivers a crypto-stealer and RAT. Get the IOCs, timeline, and first-hour runbook.

CVE-2026-9277 is a shell-quote command injection flaw in npm versions 1.1.0 through 1.8.3. See how the quote() bypass works, what to hunt, and the 1.8.4 fix.

PCI DSS 4.0 compliance Requirement 6.3.2 asks for more than an SBOM. See what runtime evidence QSAs actually want in 2026 audits.

Your cardholder data environment grew with every BaaS partner and embedded program. See how runtime evidence reconciles scope with reality.

A vendor security questionnaire response framework for fintech SaaS. Handle SIG, CAIQ, and runtime evidence requests in hours, not days.

DORA compliance asks banks to prove which ICT risks are material to operational resilience. See how runtime reachability answers Article 6 and 8.