Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The latest News and Information on Application Security including monitoring, testing, and open source.

Four incident-response decisions from the Hugging Face breach

Hugging Face was breached by a rogue OpenAI agent last week, and the intrusion continues to deliver insights and understanding. The Hugging Face team published a detailed timeline along with a 17,600-event trace streaming replay visualizing what happened, and it’s marvelously and intoxicatingly detailed. I recommend you read it if you have the time.

Better generic secrets detection starts with finding non-secrets

This article was co-written by Zach Rice and Joe Leon, both at Aikido Security. tl;dr Some credentials are meant to be public, but secret scanners still flag them as generic secrets. We wrote suppression rules for the most common ones and reduced false positives by ~2%. These rules now ship by default in Betterleaks. Secrets scanners are built on regular expressions. Each pattern targets a specific credential type, like an AWS secret access key, a GitHub PAT, or a Stripe token.

Everyone is a Developer Now - How Do We Put Guardrails in Place? | Veracode

With AI tools, **everyone** is becoming a developer. Marketing teams, finance teams, and business users are now building applications and generating code. So the big question is: In this clip, Tim Brown, CISO in Residence at Team8 and former CISO at Solarwinds, discusses the shift happening in organizations and why strong guardrails are more important than ever in the AI-coding era. Subscribe for more insights on Application Security, AI Coding, and DevSecOps.

Finding eight high-severity vulnerabilities in NodeBB in six hours

TL;DR While improving our AI Pentest, we ran a whitebox assessment on NodeBB, a forum software powered by NodeJS. The result? Eight high-severity vulnerabilities that would all be exploitable on default instances of NodeBB. This includes Cross-Site Scripting (XSS), two of which require interaction with a custom Federation server that the AI agent had to set up itself. Another affects practically every input on NodeBB due to a template injection.

Why Continuous Attestation Is Critical in the AI Coding Era

In the age of AI coding, annual audits and snapshots are no longer enough. Discover **Continuous Attestation** — the practice of producing ongoing, verifiable evidence that your applications and pipelines are always running in a trusted, policy-conformant state. In this video, Anthony Barkley, Chief Strategy Officer at Veracode, explains why independence in attestation is critical for earning trust from regulators, customers, and boards — especially when AI agents are writing code.

SQL injection isn't dead

Oops! A SQL injection bug just forced an emergency WordPress core patch last week. On July 17, WordPress shipped an emergency release to fix an unauthenticated remote code execution flaw in the core, reachable via a SQL injection that an anonymous attacker can exploit on a stock install. WordPress.org even turned on forced auto-updates because of how severe it is. Searchlight Cyber, who reported it, estimates over 500 million sites run WordPress.

Tyro's CISO: Being the "Einstein of cybersecurity" isn't enough if developers don't trust you

In leading security for major Australian fintechs, Arun Singh has learned that "You could be the Einstein of cybersecurity, but if you cannot influence the business, you're no good." Implementing a new security control developers hate influences the business, but not in a good way.

80% of New Code is AI-Generated - But 40-50% Has Vulnerabilities Find out Why

Is your organization generating up to 80% of its new code with AI? You might be proud of the speed — but are you ready for the security risks? In this video, we reveal the hidden danger: multiple studies show that **40-50% of AI-generated code changes contain vulnerabilities**. Discover why AI coding is accelerating development faster than ever — and why traditional security approaches are no longer enough.

The Best Application Security Testing Tool Isn't a Scanning Tool Anymore

For years, the application security testing tool category was defined by a simple question: can it find vulnerabilities? The better the scanner, the better the tool. That model made sense (for the most part) when humans wrote every line of code and security teams could reasonably review what developers shipped. That model is now obsolete.