Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Vibe-coding platforms let you go from prompt to a deployed app in a single session, a pace that outpaces the review cycles most teams built for slower releases. With Lovable nearing 8 million users by late 2025, and Replit past 50 million by April 2026, we wanted to answer a sharper question than “is vibe coding safe?” Does the platform generating the code change the outcome, and does one security prompt give you the same security everywhere?

Binance never chose to be on the front line of a geopolitical conflict, yet if blockchain-intelligence firms are right, that is where it ended up, and its balance sheet absorbed the first loss. Binance’s initial investigation indicates that a compromised DevOps engineer’s laptop may have given an attacker access to a service container and the ability to submit unauthorised withdrawals.

October 2026 has been an unusually loud month for critical disclosures across the ecosystem. Along with PHP2Shell, GitLab also joined the party and shipped three critical RCEs in the same month: CVE-2026-90970 (CVSS 9.9) in the self-hosted AI Gateway on October 2, then CVE-2026-97229 (CVSS 10.0) on October 12, and CVE-2026-110264 (CVSS 10.0) on October 21. The last two are integer overflow bugs in the exact same regex compiler, shipped nine days apart.

Seeing your Shopify app under review, or receiving an urgent Shopify app suspended notice from Partner Governance, immediately freezes new merchant installs. When merchants try to install your application and hit the this app is under review Shopify gate.

Shopify App Store requirements have a lot to say about app security, and almost none of it says “get a pentest.” Dig through the App Store review rules, the protected customer data requirements, the Built for Shopify criteria, and the Certified Technology Partner list, and you’ll find only one program that mentions penetration testing. Others are just expected to be secure, which is fair, except there is no clear definition of the word or process for proving the same.

We gave four AI coding tools the same prompt and asked each one to build the same application. Emergent, Replit, Lovable, and Base44 all shipped something that ran, and none of them knew a pentest was coming. We then pointed our autonomous pentest agents at all four builds, and 137 confirmed vulnerabilities came back. One finding turned up in every app, which is a CORS misconfiguration.

We built an application on Replit from a single prompt, gave it no special instructions about security, and then pentested it the way an attacker would. Replit had no advance notice that any of this was happening, and there is no vendor relationship between us. The app worked, which is worth saying first, because nothing about the build looked wrong from the outside.

CISOs are hired for their technical depth and then judged on everything else: can they get a budget approved? Can they calm an executive team at 2 a.m. while the incident is still unfolding? Can they convince a product lead to delay a launch without making an enemy? Almost no one is trained for this second job, and yet, it’s the one that decides whether a security program succeeds. This article will highlight ten crucial Chief Information Security Officer (CISO) skills.

TL;DR: On October 22, 2026, Zero Day Initiative accidentally posted six unpatched Linux kernel vulnerabilities to the public LKML. Two are CVSS 9.0 SMB RCEs; three are local privilege escalation. No mainline patches exist yet. Monitor your distribution and unload exposed modules.

Two days after PHP shipped emergency patches for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the project is back with another RCE advisory: CVE-2026-115560. Looks like PHPoclypse is going to stick around till the weekend. In this blog, we break down what CVE-2026-115560 actually is, the narrow configuration that makes it exploitable, and the one-line mitigation you can apply before the weekend.