Shai-Hulud code drop: It’s open season for supply chain attacks
The malware's public release provides a blueprint for threat actors. Take action on supply chain security.
AppSec & Supply Chain Security
Shai-Hulud code drop: It’s open season for supply chain attacks
Think AI agents are risky? Your underlying stack is too
To manage agentic AI risk, organizations need to focus more on the infrastructure they run on.
Mini Shai-Hulud tears at OSS trust
New Team PCP compromises of foundational npm packages are rocking open source.
Selective NVD enrichment: Why it matters
AI vulnerability reporting is overwhelming teams — and NIST. But for AppSec, scaling back analysis is cause for alarm.
How Mythos changes the AppSec calculus
Here are the facts on Claude Mythos — and why a layered application security framework is essential.
How agentic AI flips the trust model
As AppSec shifts focus from the components to data, your strategy needs updating. Are you on top of your trust debt?
MCP rug-pull attack worries mount
This new class of AI tool supply chain attack highlights how trust of agents can be exploited.
Can AppSec keep pace with AI coding?
AI lets software teams generate code at a rate faster than security can validate it. One way to win the race: more AI.
LLMmap puts its finger on ML attacks
Researchers show how LLM fingerprinting can be used to automate generation of customized attacks.
Vibeware: More than bad vibes for AppSec
Threat actors are leveraging the freewheeling vibe-coding trend to deliver malicious software at scale.
The CRA is coming: Are you ready?
Here's how the EU's Cyber Resilience Act will reshape the software industry — and how that accelerates advantages.
Claude Mythos: Get your AppSec game on
Anthropic's new AI is a 'step change' for exposing software flaws — but also ramps up exploits. Are you ready?
28 application security stats that matter
AI and open source are redefining the software threat landscape. Here are the key statistics you need to know.
Axios: How AppSec teams should respond
Here's a mitigations checklist and best practices. Plus: How RL’s xBOM and Spectra Assure Community can help.
How JPMC tackles software ‘trust debt’
JPMorgan Chase CISO Patrick Opet discussed his letter on third-party software risk — and how that has played out.