Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

PCI DSS 4.0.1 is the first major standard to name API business logic as an attack type you must address. Requirement 6.2.4 lists attacks on business logic, including attempts to abuse or bypass application features through the manipulation of APIs, alongside injection and access control flaws. The timing matters. All requirements, including the ones that were future-dated, have been mandatory since 31 March 2025. Your next assessment will test controls that were optional a year ago. The reason is simple.

Brookings and the World Economic Forum say agent governance must be continuous, scoped in advance, evidenced, and monitored at runtime. We think that bar is correct, and that most organizations are nowhere near it. Most of what companies call AI agent governance today is paperwork. A review board approves the use case. A policy document says agents must follow least privilege. A risk assessment gets filed. Then the agent ships, and nobody can say what it actually did on Tuesday. That isn't governance.

On October 21, 2026, two critical vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were publicly disclosed. Both are rated 9.2 and both allow remote code execution on vulnerable servers. Government portals, public services, and commercial sites across multiple countries went offline as a precaution while teams rushed to patch. But the flaws were known on October 20, and the patch didn’t ship until the 21st.

Researchers pulled real, leaked API keys out of three LLMs using only API output. Here is how AI agents carry secrets from developer laptops into model context, and how to stop them before the model sees them.

APRA's information security standard already covers the APIs your agents run on. Most institutions cannot yet evidence it. All APRA-regulated institutions in Australia are bound to meet CPS 234. This is the Prudential Standard for Information Security. Whether that's a bank, insurance provider, or super fund, they all fall under CPS 234, as do their third-party providers. Together, these institutions hold trillions of dollars in assets.

Nearly half of the organizations we surveyed — 49.8% — confirmed or suspected that an AI agent in their environment took an action in the past year that nobody intended, expected, or authorized. That is not a prediction. It is what security and technology professionals told us when we asked them directly, across a survey of over 380 organizations, about their experience over the last 12 months. Agentic AI has moved fast. The data shows it has moved faster than most organizations can govern.

Open banking drives financial innovation but introduces new cybersecurity risks through APIs, exposed credentials and third-party integrations. Discover how cyber threat intelligence helps financial institutions identify emerging threats, improve visibility and strengthen security.

AI Detection and Response (AI-DR), also called AI runtime security, is quickly becoming a must-have. Prompt injection, jailbreaks, and data leakage are real, and the prompt is often where attacks begin. But the prompt is only the first hop. In an agentic enterprise, a single instruction can trigger activity well beyond the LLM, all the way to your business systems and data.

Ask an AWS security team how many accounts they run, and the honest answer is usually a range. Enterprises on AWS operate anywhere from 100 to 5,000 accounts. Most security teams can see only a fraction of them. That gap is why we built Wallarm Infrastructure Discovery. This week, it was named Enterprise Cloud Security Solution of the Year in the 10th annual CyberSecurity Breakthrough Awards. Here's what it does, and why the judges picked it.