Why the annual penetration test stopped matching the way software actually ships, and what continuous, AI-driven testing changes about it.

Imagine it’s Friday evening and your release is scheduled in an hour. Just as the deployment begins, the security team finds a critical…

TL;DR This GitLab patch release, shipped on July 8, 2026, covers versions 19.1.2, 19.0.4, and 18.11.7. The update fixes eight security flaws across Community and Enterprise Edition. The most sever…

Are you making these critical errors? Learn how attackers exploit cloud misconfigurations — and how to stop them.

Part 1 of a Technical Series on Building Security Tools from Scratch Author: Agniswar Mukherjee

In 2021, attackers compromised SolarWinds’ build pipeline — not the product itself — and slipped malicious code into a signed, trusted…

Part 1 of my AppSec transformation series — auditing, exploiting, and rebuilding a 2022 inventory system from the ground up.

Subtitle:

Introduction

The vulnerabilities that do not live in a single line of code, and why the tool that finds 300 issues still misses the one that matters.

Musa Ndlala: this article is a bit late but better late than never

What I learned rolling out Application Security inside a large engineering organization

Category: AWS Security | DevSecOps | Cloud Security | Secrets Management

K02 — base64 is not encryption, etcd stores everything, and every pod has a credential it may not need.

AI can write code in seconds. But shipping secure code still requires engineering judgment.

The goal of DevSecOps isn’t to slow developers down. It’s to help them build secure software without getting in their way.

TL;DR A critical Gitea vulnerability, CVE-2026-58443 (CVSS 9.6), lets a public-only token push commits into a private repository. Maintainers fixed it in v1.27.0. The security advisory publishes b…

Every major platform now has an AI that suggests security fixes. Only one proves the vulnerability is exploitable in your live…

Understanding model poisoning, insecure serialization, and how to harden enterprise MLOps pipelines against supply chain exploitation.

Understanding unauthenticated RCE, AI-targeted ransomware (ENCFORGE), and how to harden enterprise MLOps pipelines against active…