Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Engineering teams lose hours of their work week to access bottlenecks. Shared credentials, manual checkouts, and ticket-based privileged access management (PAM) tools are poorly equipped to keep up with the speed and complexity of today’s distributed engineering environments. These bottlenecks stand in the way of critical engineering work. This can ultimately introduce real security risks (but more on that later).

Multi-factor authentication (MFA) is used to protect user accounts. It adds an extra layer during login, but MFA bypass attacks still happen. In many attacks, MFA is not broken. Attackers simply avoid it. They take control of sessions that are already logged in or trick users into signing in through pages that appear legitimate. Once access is granted, MFA is no longer involved. This is where assumptions start to break.

The Monthly Intelligence Insights report provides a summary of top threats curated, monitored, and analyzed by Securonix Threat Labs in December 2025. The report also includes a synopsis of the threats, indicators of compromise (IoCs), tactics, techniques, and procedures (TTPs), and related tags. Each threat has a comprehensive summary from Threat Labs and search queries from the Threat Research team.

As cloud environments sprawl and engineering teams scale, the number of identities you manage has exploded. It’s no longer just employees and contractors; CI/CD pipelines, service accounts, API tokens, and AI-powered agents are all asking for access to production systems and sensitive data. It’s no shock that identity has become a top-line priority for security and platform leaders.

AI systems are moving fast, sometimes faster than the guardrails meant to contain them. In this episode of Security Matters, host David Puner digs into the hidden risks inside modern AI models with Pamela K. Isom, exploring the governance gaps that allow agents to make decisions, recommendations, and even commitments far beyond their intended authority. Isom, former director of AI and technology at the U.S.

To kick off 2026, I’m proud to share that we’ve released the inaugural edition of the SafeBreach State of the Breach Report. This report has roots going back over 11 years when SafeBreach was originally founded. Even then, our goal was always to empower security leaders to better understand the efficacy of their security programs and make data-driven decisions—no more guessing what to do.

A recent stack buffer overflow vulnerability in Redis, assigned CVE-2025-62507, was fixed in version 8.3.2. The issue was published with a high severity rating and assigned a CVSS v3 score of 8.8. According to the official advisory, “a user can run the XACKDEL command with multiple IDs and trigger a stack buffer overflow, which may potentially lead to remote code execution”.

At JFrog, our mission has long been to power the future of software, and we believe that future is undeniably cloud-native. This is why we’ve architected our platform as a container-first, Kubernetes-native SaaS—built for performance at scale on the world’s leading cloud infrastructure. Our deep commitment to cloud excellence has reached a major milestone in our long-standing collaboration with Amazon Web Services (AWS): JFrog has achieved AWS Security Competency status.

The recent disclosure of what security researchers are calling "the most severe AI-driven vulnerability uncovered to date" in ServiceNow's platform serves as a stark reminder: securing agentic AI isn't just about new AI-specific controls; it requires getting the fundamentals right first.

As per Traceable’s 2025 State of API Security report, only 21% of the >1500 respondents surveyed across the globe showed confidence in detecting attacks at the API layer. Furthermore, only 13% were capable of preventing >50% of API attacks. This is when the API sprawl is still burgeoning. The challenge, thus, is no longer volume but maturity.