Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The latest News and Information on Application Security including monitoring, testing, and open source.

AWS Security Live from Black Hat 2026 with Johnny Wong from Veracode

In this episode, hosts Ryan and Brian are joined by Johnny Wong, VP of Solutions Architecture at Veracode, to explore how AI-assisted “vibe coding” is changing the way software gets built—and the new security risks that come with it. While large language models are making developers faster and more productive, studies shared in the discussion show that a significant portion of AI-generated code still contains security vulnerabilities, raising concerns about scale and speed in modern development pipelines.

Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack

On August 20, we detected two popular Rust crates from the same maintainer, append-only-vec (4M downloads) and arrayref (244M downloads), were compromised. The attacker added a malicious dependency on a package called proc-macro1, which downloads a remote payload during the build and executes it on the developer's machine.

Frontier AI Application Security: Every Second Counts

Somewhere in the last few months, the math of application security quietly broke. Anthropic’s Claude Mythos Preview didn’t just analyze code, it found a 27-year-old vulnerability in OpenBSD, a 16-year-old bug in FFmpeg, and a 17-year-old remote code execution flaw in FreeBSD, entirely on its own. Then it went further: it built working exploits for them. No human guidance. No months of manual research. And by Anthropic’s own account, this is only a preview of what’s coming.

Meet Captain Veracode | Guardian of Secure Code

In the year 2079, vulnerabilities are endless and breaches are a daily reality. Jordan Kodak, a weary engineer, dreams of a world where developers can innovate without fear. She leaves Earth in search of Secura Prime—a legend of flawless code—and decades later receives a distress signal from a temporal anomaly. Meet Cipher, a sentinel from 2177, where secure coding finally took root. Armed with future knowledge, Jordan realizes the utopia she sought isn’t a place… it’s a practice.

What is AI harness engineering?

Harness engineering is the practice of building the layer, including code, that turns an AI model from a text generator into an agent that can take actions. In short, an AI agent is a model plus a harness. The model decides what to do next, and the harness makes it happen, connecting the model to tools, context, external systems, and validation. In a lot of practical work, and especially in security work, the harness decides the quality of the output more than the choice of model does.

Who was behind the attack? Possibly nobody

The fever dream continues, and I'm not even in Vegas for Hacker Summer Camp. Last week I wrote about Anthropic disclosing that one of their models published live malware to PyPI while believing it was inside a simulation. I was running a fever when I read the report. The metaphor was too good: a model that couldn't tell simulation from reality, covered by a writer who wasn't sure which way was up. I thought that was a one-week story. Very naive of me to have so much faith, I know.

Why Traditional SAST Fails on AI-Generated Code

AI didn't just speed up software development, it changed what application security programs must defend. As AI coding assistants generate code at machine speed and developers integrate AI agents, models, and RAG pipelines into production, traditional scanners generate endless backlogs of unprioritized alerts.

AppSec: When Bandwidth Isn't the Bottleneck

AppSec teams are frequently told that a lack of bandwidth is why vulnerability backlogs keep growing. In reality, the bottleneck is not team size, it is the lack of contextual prioritization and agentic triage. When traditional scanners hand security teams thousands of findings without reachability context, developer velocity stalls. In this webinar, Mend.io security experts unpack why bandwidth is not the real bottleneck in modern software security and show you how to streamline triage, automate remediation, and secure code at AI speed.