TL;DR The Argo CD project has fixed four critical security flaws, each rated 9.9 on CVSS. Three of these Argo CD vulnerabilities let a user run commands or read files inside the argocd-repo-server…

TL;DR Gitea has shipped 27 security fixes across versions 28.0.0 and 28.1.0. This Gitea security update closes server-side request forgery (SSRF) paths, an installer bug that grants admin sessions…

Why security assessments should be scoped around business risk — not generic checklists.

Someone is using a poem on GitHub to coordinate a cryptomining botnet called PoeLLM, according to Lumen’s Black Lotus Labs. Gamers, if you…

This was not a story about AI replacing security engineers. It was a demonstration of how AI becomes useful when humans refuse to give it…

Threat Modeling vs. Penetration Testing: The $80 Million Lesson From Capital One

TL;DR GitLab released versions 19.4.2, 19.3.4 and 19.2.8 on October 8, 2026, fixing 24 security issues. The worst, CVE-2026-97229, is a GitLab critical vulnerability with a CVSS score of 10.0. It …

Digital certificates are a fundamental part of internet security. They help websites establish encrypted connections, authenticate their…

Fifteen DevSecOps and application security interview questions covering what DevSecOps really means, secure development lifecycle…

No zero day exploit, no phishing. Just a trust decision nobody made on purpose, and how to close the same gap in your own pipelines.

A practitioner’s walk through SAST, DAST, manual pentesting and the OWASP checklist, and how to layer them so gaps don’t line up.

GitLab Patches a Maximum-Severity Flaw GitLab has fixed a critical vulnerability that, under certain conditions, lets attackers run arbitrary code on a server. They need no password and no user in…

How a missing RBAC policy check exposed security actions and resources to low-privileged users.