Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

TL;DR: Mend SCA now scans Bun-managed JavaScript and TypeScript projects, including both the text-based bun.lock and legacy binary bun.lockb lockfiles. It detects direct and transitive dependencies automatically, works in the Mend CLI and every repository integration, and supports reachability analysis so teams can fix the vulnerabilities their code actually calls first.

Five days after PHP shipped the fix, CISA added both PHP2Shell flaws to its Known Exploited Vulnerabilities (KEV) catalog. Federal civilian agencies have until October 29 to remediate. Last week’s question was whether attackers could turn the flaws into working shells. This week’s question is which of your images and hosts still run an affected PHP build, and who can fix each one.

On October 21, 2026, a malicious release of litellm, the Python library and proxy for calling LLM provider APIs, was published to PyPI as version 1.107.0. All seven compiled wheels carried three extra files that install straight into the root of site-packages: a.pth hook that runs a credential stealer every time Python starts, and a sitecustomize.py that starts a background loader built to fetch and run remote Python code every hour. The package has had more than 92 million downloads over the past month.

On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to close two critical remote code execution flaws in the PHP runtime. Both are rated CVSS v4.0 9.2. Together they go by the name “PHP2Shell.” The flaws sit in PHP itself, not in any application built on it. A secure codebase running on an affected PHP build is still exposed. That makes this an inventory problem first and a patching problem second.

ISO/IEC 42001 is the first international standard for artificial intelligence management systems (AIMS). It provides a certifiable framework for organizations to develop, deploy, and govern AI systems responsibly. It helps you manage AI-specific risks, such as bias and security, and align with emerging regulations. Who should implement it.

AI coding agents need access to real development context to be useful. They read repositories, modify files, execute commands, call tools, and communicate with external models. Docker Sandboxes gives those agents an isolated environment where they can work without unrestricted access to the developer’s host. But consider a simple scenario. An agent running entirely inside its sandbox reads a credential from a project configuration file and includes it in an otherwise legitimate request to its LLM.

Mend.io has proactively upgraded 184 open source organizations and GitHub users to the Mend Renovate Community (OSS) plan, with no request required. The upgrade covers about 3,000 repositories with roughly 4 million combined GitHub stars. Maintainers get higher resource limits, more concurrency, and access to Merge Confidence.

The NIST Secure Software Development Framework (SSDF) is a set of fundamental, outcome-based practices that integrate security throughout the software development lifecycle (SDLC). Documented in NIST SP 800-218, it helps organizations reduce vulnerabilities, prevent recurrences, and establish a common language for secure development. The SSDF outlines dozens of tasks grouped into four high-level categories.

The speed of AI integration is rapidly outpacing corporate governance capabilities. Generative AI is now embedded in development workflows and business applications, while agentic AI can make decisions and take actions with limited human intervention. That governance gap is becoming harder to ignore. Gartner predicts that more than 40% of agentic AI projects will be canceled by the end of 2027 because of escalating costs, unclear business value, or inadequate risk controls.

Findings got cheap. Verified closure did not. That AppSec remediation gap is the actual problem. AppSec spent a decade winning the wrong race. We got very good at finding things. Scanners in CI. SCA on every manifest. SAST on every pull request. Container and IaC checks on the way to the cluster. Then AI arrived and did what AI does to a solved problem: it made discovery cheaper, louder, and continuous. The same model that writes the function will also enumerate the ways to break it.