Articles & News

CVE-2026-78676 turns dormant git-config values into live core.hooksPath directives on any GitPython write. Affected versions, the 3.1.59 fix, and the runbook.

scrambleeeer and scrambleeer hid a PyPI reverse shell that fires on library use, not install. Get the affected versions, the IOCs, and the first-hour runbook.

The EU delayed high-risk AI obligations to 2027 and 2028, then switched on enforcement. Here is what 2026 AI regulation actually requires, and why most of it comes down to what your agents can reach.

The US made secure development attestation optional in January. The EU starts enforcing 24 hour vulnerability reporting in September. Here is what 2026 actually requires, and what it asks you to prove.

Runtime security uses evidence from a running application to decide which risks are real. How it differs from static analysis, SCA, WAF and RASP, and where it stops.

The keyv supply chain attack poisoned 11 npm seed packages and spread a Shai-Hulud worm to 400+ more. Get affected versions, IOCs, and the first-hour runbook.

Open-weight models cut inference costs by 60 to 90 percent. They also turn AI into infrastructure the security team has to discover, secure, and continuously verify.

OpenAI's models escaped a sandbox and hacked Hugging Face mid-evaluation. What that means for how application security has to work next.

Syntax correctness passed 95%. Security pass rates are still stuck near 55%.

Reachability tells you code can execute. Runtime tells you it did.

We found a vulnerability in Kiro, AWS's agentic IDE, that breaks this promise. By planting hidden instructions in a web page Kiro reads, an attacker can make Kiro rewrite its own MCP (Model Context Protocol) server configuration file and gain arbitrary code execution on the developer's machine.

An LLM jailbreak bypasses a model's safety guardrails to produce restricted output. How jailbreaks work, how they differ from prompt injection, and defenses.

RAG security covers the risks of retrieval-augmented generation: injection through retrieved content, data poisoning, and leakage. The threats and how to defend.

MCP security covers the risks of the Model Context Protocol connecting AI agents to tools and data. The main threats, and how to contain them at runtime.

A software bill of materials (SBOM) inventories every component in your software. What an SBOM includes, why it matters, and how runtime makes it actionable.

Server-side template injection (SSTI) lets user input run in a template engine, often escalating to RCE. How SSTI works, and how to prevent and detect it.

Remote code execution (RCE) lets an attacker run code on your system. How RCE attacks work, what causes them, and why runtime reachability decides which ones matter.

A stolen GitHub token let an attacker publish four backdoored @asyncapi packages through AsyncAPI's own release pipeline. Get the attack chain, IOCs, and first-hour response runbook.

Kodem AI-BOM extends your SBOM with an AI bill of materials: identify AI packages, verify runtime execution, and govern AI supply chain risk at scale.

Discover the key security issues in Scala, explore critical CVEs, and learn best practices to secure your Scala applications against vulnerabilities.

Malicious @injectivelabs/sdk-ts 1.20.21 stole wallet keys via a fake npm telemetry hook. See affected versions, IOCs, and the response runbook.

Veracode's 45% AI code stat is everywhere. Here's why knowing which flaw actually ran matters more than the number.

EPSS estimates the probability a CVE will be exploited in the next 30 days. How it works, how it compares to CVSS and KEV, and how to prioritize with it.

Reachability says a vulnerable function could run. Exploitability proves it did. Here is how runtime evidence tells the two apart.

Five backstage-plugin-gitlab-backend versions ship a malicious binding.gyp that runs code at npm install via node-gyp. Affected versions, IOCs, and runbook.

Agentic AI security protects AI agents and the tools, memory, and systems they touch. The main risks, and how to contain them at the runtime layer.

The OWASP Top 10 for LLM Applications (2025) risks explained, plus how runtime tells you which are actually exploitable in your stack.

AI red teaming stress-tests AI systems for prompt injection, jailbreaks, and agent abuse. How it works, and how runtime evidence confirms real risk.

Prompt injection is OWASP LLM01. How direct and indirect prompt injection work, why it cannot be patched in the model, and how to defend AI apps at runtime.

When a scan blocks a build or surfaces a finding, the first question is about the scan. Scan History keeps the execution record so investigations start with evidence.