Application Security

AI coding is fueling a secrets-sprawl crisis few CISOs are containing

CISOs should treat secrets sprawl as a governance challenge. This means enforcing clear ownership, adopting short-lived credentials, and extending security controls across the entire software development lifecycle.

By Andrada Fiscutean

May 18, 20268 mins

Application SecurityArtificial IntelligenceSecurity

Articles

RCE by design: MCP architectural choice haunts AI agent ecosystem

Unsafe defaults in MCP configs open servers to possible remote code execution, as evidenced by several commercial services and open-source projects.

By Lucian Constantin

Apr 16, 2026 7 mins

Application SecurityArtificial IntelligenceSecurity

Old Docker authorization bypass pops up despite previous patch

A 10-year-old issue involving Docker Engine and the AuthZ authorization plug-in lives again to enable attackers to gain root-level access to host systems.

By Lucian Constantin

Apr 10, 2026 4 mins

Application SecuritySecurityVulnerabilities

What Anthropic Glasswing reveals about the future of vulnerability discovery

A closed consortium including tech giants and top security vendors gets early access to a model Anthropic says can autonomously discover software vulnerabilities at scale. The implications for cybersecurity’s future could be significant.

By Cynthia Brumfield

Apr 7, 2026 5 mins

Application SecurityDevSecOpsTechnology Industry

Supply chain security is now a board-level issue: Here's what CSOs need to know

Security isn't just your problem anymore — it's the board's. With 97% of apps using open-source, CSOs need to ditch the false positives and get serious about SBOMs.

By Scott Register

Apr 7, 2026 9 mins

Application SecurityMarketsTransportation and Logistics Industry

Veracode Static Analysis: The Right Scan, At The Right Time, In The Right Place

Veracode Static Analysis: Meeting the Modern AppSec Challenge

By Veracode

May 14, 2020 1 min

Application SecuritySecurity

Security awareness is not a control: Rethinking human risk in enterprise security

Training people to spot phishing is great for culture, but it's a poor safety net; real security means building systems that don't break when someone has a bad day.

By Oludolamu Onimole

Apr 1, 2026 10 mins

Application SecurityPhishingSocial Engineering

Attackers trojanize Axios HTTP library in highest-impact npm supply chain attack

With almost 175,000 npm projects listing the library as a dependency, the attack had a huge cascade effect and shows how quickly a compromised package can propagate through the ecosystem.

By Lucian Constantin

Mar 31, 2026 7 mins

CyberattacksDevSecOpsNode.js

APIs are the new perimeter: Here’s how CISOs are securing them

Today’s attack surface is shifting from the endpoint to the API, and AI and third-party SaaS are worsening the issue. CISOs offer advice for API defense.

By Bill Doerrfeld

Mar 30, 2026 14 mins

APIsApplication SecurityIdentity and Access Management

Runtime: The new frontier of AI agent security

Security leaders say monitoring agent behavior inside enterprise systems may be the next major challenge for CISOs.

By Cynthia Brumfield

Mar 17, 2026 10 mins

Application SecurityArtificial IntelligenceDevSecOps

14 old software bugs that took way too long to squash

As these examples show, vulnerabilities can lurk within production code for years or decades—and attacks can come at any time.

By Josh Fruhlinger and John Leyden

Mar 5, 2026 17 mins

Application SecurityVulnerabilities

Why application security must start at the load balancer

Most breaches don’t outsmart your stack; they walk through a permissive load balancer you tuned for speed instead of trust.

By Vishnu Gatla

Feb 27, 2026 8 mins

Application SecuritySecurity

The new paradigm for raising up secure software engineers

The new challenge for CISOs in the age of AI developers is securing code. But what does developer security awareness even mean in the era of vibe coding?

By Ericka Chickowski

Feb 18, 2026 10 mins

Application SecurityDevSecOpsSecurity

Software developers: Prime cyber targets and a rising risk vector for CISOs

From technical compromise to AI-driven attacks, cyber criminals increasingly see software developers as prime targets, creating systemic risks CISOs must address.

By John Leyden

Feb 9, 2026 9 mins

Application SecurityDevSecOpsSecurity