.avif)
News
The CVE spike across major software companies is a remediation problem
CVE volume is climbing across major software companies, and a federal audit shows even NIST couldn't keep up. Here's why remediation speed, not disclosure count, is the number that actually matters.
.png)
Better generic secrets detection starts with finding non-secrets
Some API keys are meant to be public. Betterleaks now removes them from generic secret findings, dropping thousands of false positives per scan.
SQL injection isn't dead
The fix for SQL injection is decades old and still works. So why did WordPress core just need an emergency patch for one? The data, and how to defend against it.
The upgrade trap: when upgrading is the wrong answer to a CVE
Upgrading to fix a CVE sounds straightforward. But the patched version often breaks your app, hasn't shipped yet, or doesn't exist. Here's why, and what actually works.
How to maintain code quality standards with AI code and vibe coding
Vibe coding ships features fast and leaves review debt behind. See how benchmarked, per-rule code quality checks give teams one consistent answer across PRs and repos.
And another one. GitHub ships break-glass credential revocation
Break-glass credential revocation is live on GitHub Enterprise. The Trivy and Microsoft durabletask repeats show why fast, complete revocation was needed..
npm now freezes high-impact accounts after risky account changes
A look at npm's new 72-hour account freeze, what triggers it, what it blocks, and how it works alongside trusted and staged publishing.
Everybody's shipping code they can't read
With AI, everyone's a developer now, and a lot of code gets shipped without a careful review from trained eyes.
Full Fathom Five: The context of Anthropic’s Mythos-class public release
You never needed Mythos to find your IDORs and business logic flaws. A look at what Anthropic shipped with Fable 5, and why infosec stays a people problem at heart.
npm v12 delivers one of the biggest security improvements in years
npm v12 makes install scripts opt-in by default, closing the install-time execution path behind a year of npm supply chain worms from Nx to Red Hat.
Code is being written everywhere, and the device is the only constant
Developers are coding everywhere. AI agents, Slack bots, and MCP servers have made the developer device the biggest security blindspot.
Get secure now
Secure your code, cloud, and runtime in one central system.
Find and fix vulnerabilities fast automatically.
