CVE-2025-60021 (CVSS 9.8): command injection in Apache bRPC heap profiler
This research is published following the public release of a fix and CVE, in accordance with coordinated vulnerability disclosure best practices. CVE‑2025‑60021, a critical command injection issue...
Read Blog
Will AI agents ‘get real’ in 2026?
In my house, we consume a lot of AI research. We also watch a lot—probably too much—TV. Late in 2025, those worlds collided when the AI giant Anthropic was featured on “60 Minutes.” My husband...
Read Blog
AI agents and identity risks: How security will shift in 2026
The pace of technological change is relentless. Not long ago, our migration to the cloud and the automation of CI/CD pipelines dominated the conversation. Now, AI agents are reshaping how we think...
Read Blog
When cybercrime meets cyberwarfare
Across today’s threat landscape, the divide between cybercrime and cyberwarfare is disappearing. Financially motivated groups and state-sponsored actors rely on the same tactics, techniques, and...
Read Blog
Sandworm in the supply chain: Lessons from the Shai-Hulud npm attack on developer and machine identities
Do you know why Shai-Hulud should raise your hackles? Unless you’ve spent time on Arrakis in Frank Herbert’s Dune or the npm ecosystem this month, the name Shai-Hulud might not ring a bell. In...
Read Blog
Is autofill safe? Clickjacking risks and security tradeoffs explained
When new security research hits the headlines, it often sparks a predictable wave of worry: should we turn off features we rely on? Should we rethink basic workflows? That’s exactly the case with...
Read Blog
Why secret sprawl may be your biggest security threat (and how to help fix it)
Picture this: You’re having your morning coffee when your phone buzzes with the kind of alert that makes security professionals break into a cold sweat. A single API key, leaked on GitHub months...
Read Blog