Application Security 21 Jul 2026
WP2Shell: Mass Exploitation Threat to WordPress
WP2Shell automates WordPress vulnerability exploitation to gain web shell access against millions of vulnerable sites.
Read more →
BLOG
Blog
Build notes, stack choices, and the way we ship for Indonesian teams.
Application Security 20 Jul 2026
Gold Eagle Clearinghouse: Gap Without Clarity
Gold Eagle Clearinghouse has emerged as an effort to close the threat intelligence sharing gap between organizations, but its operational transparency remains questioned.
Read more →
Application Security 19 Jul 2026
The Real AI Threat Is Blind Trust
Organizations treating AI output as ground truth without verification create systemic blind spots in their security posture.
Read more →
Application Security 18 Jul 2026
Inc Ransomware Exploits SonicWall SMA Zero-Days
Inc ransomware leverages SonicWall SMA zero-days for initial access, signaling a tactical shift from social engineering to exploitation of unpatched perimeter appliances.
Read more →
Application Security 17 Jul 2026
Agentic AI Security: Three Critical Questions
Agentic AI security demands a new framework: runtime authorization, per-action blast radius, and decision chain observability.
Read more →
Application Security 16 Jul 2026
CISA Vendor-Researcher Collaboration Framework
CISA releases a vendor-researcher collaboration framework establishing operational standards for coordinated vulnerability disclosure, including safe harbor provisions and response timelines.
Read more →
Application Security 15 Jul 2026
Record Patch Tuesday: Vulnerability Triage at Scale
July 2026 Patch Tuesday broke the record for CVEs in a single batch, exposing the limits of manual triage and accelerating risk-based vulnerability prioritization adoption.
Read more →
Application Security 14 Jul 2026
When CISA Itself Failed to Guard Secrets on GitHub
CISA's GitHub leak proves that secret management fails even at organizations with the highest security standards — lessons for every engineering team.
Read more →
Application Security 13 Jul 2026
ATM Crypto Software Bugs Open Jackpotting Risk
Fresh vulnerabilities in ATM cryptocurrency software enable jackpotting attacks that force machines to dispense cash without authorization.
Read more →
Application Security 12 Jul 2026
Healthcare Cyberattacks Surge in 2026
The healthcare sector is experiencing a surge in cyberattacks in 2026 due to high-value data, legacy systems, and operational pressure.
Read more →
Application Security 11 Jul 2026
Jen Ellis: Bridging Cyber and Policy
Jen Ellis is pioneering efforts to connect the cybersecurity community with political machinery for evidence-based cyber policy.
Read more →
Application Security 10 Jul 2026
Iran Cyber Ops Expand Beyond Infrastructure
Iran-affiliated threat actors are expanding their cyber operations beyond traditional critical infrastructure targets, hitting software supply chains and commercial sectors with increasingly sophisticated techniques.
Read more →
Application Security 9 Jul 2026
Mexico's National Cyber Plan Tested
Mexico's new national cybersecurity plan faces its first real-world test, examining whether policy can transition into operational capability.
Read more →
Application Security 8 Jul 2026
Fake Job Scam Targets Marketers' Google Accounts
Threat actors leverage fake job postings from well-known brands to lure marketing professionals into surrendering their Google credentials.
Read more →
Application Security 7 Jul 2026
BusySnake Infostealer Targets Critical Infrastructure
BusySnake is a new infostealer specifically targeting critical infrastructure networks through credential harvesting on OT operator endpoints.
Read more →
Application Security 6 Jul 2026
Apple Reverses Patch Policy to Secure AI Era
Apple is shifting from monolithic patch cycles to modular rapid-response patching to address the new attack surface created by AI integration across its device ecosystem.
Read more →
Application Security 5 Jul 2026
Cybercrime Risk Shifts to SMBs
Cybercrime risk in Australia is declining for large corporations while SMBs become the primary target due to weak security postures.
Read more →
Application Security 4 Jul 2026
Chinese LLMs Widen the Attacker-Defender Gap
Chinese LLMs with minimal guardrails are widening the capability gap between threat actors and defense teams, enabling more sophisticated attacks with lower technical barriers.
Read more →
Application Security 2 Jul 2026
Adaptive Phishing: Payloads That Shift per Device
Next-gen phishing kits use automated device fingerprinting to customize payloads per victim device and OS, making signature-based detection ineffective.
Read more →
Application Security 1 Jul 2026
China-Linked APT Targets Southeast Asia Systems
A threat actor group affiliated with China has been identified targeting critical infrastructure in Southeast Asia, spanning energy, telecom, and government systems.
Read more →
Application Security 30 Jun 2026
Djinn Stealer Targets Cloud and AI Keys
The Djinn Stealer malware actively targets cloud infrastructure credentials and AI platform tokens, marking a shift in threat actor focus to high-value enterprise assets.
Read more →
Application Security 29 Jun 2026
Cisco Acquires Astrix and WideField for NHI
Cisco adds Non-Human Identity capabilities to its security stack through acquiring Astrix Security and WideField AI, targeting machine credential governance.
Read more →
Application Security 28 Jun 2026
Third-Party Vendor Risk in Education Sector
Third-party vendor breaches in education are surging, exposing systemic weaknesses in vendor risk management practices that institutions have long neglected.
Read more →
Application Security 27 Jun 2026
Confidence in Autonomous Pentesting Falls
Confidence in AI-driven pentesting is falling due to limitations in detecting business logic vulnerabilities and complex attack chains.
Read more →
Application Security 26 Jun 2026
Cisco CUCM Flaw Weaponized in Under 24 Hours
A critical Cisco CUCM vulnerability was weaponized by threat actors within 24 hours of disclosure, demonstrating that patch timelines must be measured in hours.
Read more →
Application Security 25 Jun 2026
CISA Guide: Federal Zero Trust Transition
CISA published a Zero Trust transition guide for federal agencies, providing a practical framework for organizations moving away from perimeter-based security models.
Read more →
Application Security 24 Jun 2026
Salesforce Attacks Expand as Icarus Leaks Data
The Icarus group expanded Salesforce attack impact by leaking data from newly identified victims, indicating broader initial exploitation.
Read more →
Application Security 23 Jun 2026
Crypto Heist via Fake Reputation Campaign
Threat actors spent months building fake trust infrastructure before executing a major crypto theft, demonstrating social engineering at scale.
Read more →
Application Security 22 Jun 2026
Operation Escaneo: LatAm Threat Landscape Shift
Operation Escaneo marks a tactical shift among Latin American threat actors from opportunistic attacks to structured campaigns.
Read more →
Application Security 21 Jun 2026
Novo Nordisk Breach Exposes Dev Pipeline Risk
The Novo Nordisk breach exposed weaknesses in their CI/CD pipeline and software development processes, reinforcing that software supply chain security must be a top priority for large organizations.
Read more →
Application Security 20 Jun 2026
AI and Stress Reshape Cybersecurity Teams
Operational stressors and AI adoption simultaneously force fundamental restructuring of cybersecurity teams, changing roles, skills, and workflows across the industry.
Read more →
Application Security 19 Jun 2026
Popa Botnet Linked to Public Israeli Firm
The Popa botnet infecting millions of IoT devices is connected to a publicly-traded Israeli company, raising serious questions about corporate accountability in cybercrime.
Read more →
Application Security 17 Jun 2026
Fileless Phantom Stealer Targets Browser Credentials
Dark Reading covers Phantom Stealer, a fileless stealer that exfiltrates browser credentials from memory. Lessons on application security posture and behavior-based detection.
Read more →
Application Security 16 Jun 2026
Copilot SearchLeak Attack Enables One-Click Data Theft
Researchers disclose Copilot vulnerability that enables one-click data theft via indirect prompt injection. Three mitigations security teams should deploy now.
Read more →
Application Security 15 Jun 2026
US Cracks Down on Anthropic: The AI Regulation Signal Security Teams in Indonesia Should Watch
US regulators are cracking down on major AI models like Anthropic. What does it mean for AI adoption in Indonesia, and what do security teams need to prepare?
Read more →
Application Security 4 Jun 2026
Critical Microsoft 365 Android Flaw Left a Debug Flag in Production — Any App Could Steal Your Account Token
A development flag accidentally left active in Microsoft 365 Android apps allowed any app on the same device to steal account tokens — giving attackers access to email, files, and calendar without any user interaction.
Read more →
Application Security 3 Jun 2026
Google Android June 2026 Update: 124 Vulnerabilities Patched, One Actively Exploited
Google patches 124 Android vulnerabilities in June 2026, including one actively exploited flaw allowing privilege escalation without user interaction.
Read more →
Application Security 2 Jun 2026
How AiTM Phishing Bypassed 2FA to Hit 35,000 Users: An Analysis
A sophisticated AiTM phishing campaign targeted 35,000 users in April 2026, bypassing 2FA by capturing session tokens after login. Here's how it worked and how to protect your organization.
Read more →
Application Security 1 Jun 2026
Update Chrome Now: Critical Vulnerabilities Allow Remote Code Execution
Google released urgent Chrome security update patching 16 vulnerabilities including two critical flaws (CVE-2026-9111, CVE-2026-9110) that could allow remote code execution and UI spoofing attacks.
Read more →
Application Security 1 Jun 2026
GitHub Internal Repositories Breached via Malicious VS Code Extension
GitHub confirmed a breach where attackers accessed 3,800 internal repositories through a poisoned Visual Studio Code extension, highlighting the growing threat of supply chain attacks on developer tools.
Read more →
Application Security 31 May 2026
AI Security in 2026: Treat Agents Like Digital Coworkers
AI tools need identity, permissions, logs, and limits. Security strategy must evolve as agents start acting inside business systems.
Read more →
Application Security 30 May 2026
Next.js Authorization Bypass: CVE-2024-46991 Deep Dive
Critical Next.js vulnerability allows bypassing middleware-based authorization through pathname normalization inconsistencies.
Read more →
Application Security 30 May 2026
Symfony PATH_INFO Authorization Bypass: GHSA-3rg7-wf37-54rm
Symfony HTTP Foundation vulnerability allows authorization bypass through incorrect PATH_INFO parsing.
Read more →
Application Security 30 May 2026
GoFiber Flash Cookie DoS: Unbounded Memory Allocation Attack
Critical GoFiber vulnerability allows denial of service through crafted flash cookies that trigger massive memory allocation.
Read more →
Application Security 30 May 2026
OWASP Top 10 2025: What Changed and Why It Matters
Comprehensive analysis of OWASP Top 10:2025 changes, including new entries and modern security risks for web applications.
Read more →
Application Security 30 May 2026
GoFiber Session Fixation Vulnerability: CVE-2024-38513
GoFiber session fixation vulnerability allows attackers to hijack user sessions through predetermined session identifiers.
Read more →
Application Security 30 May 2026
PHP Core Security Audit 2025: Lessons and Findings
The PHP Foundation's comprehensive 2025 security audit reveals critical findings and lessons for the PHP ecosystem.
Read more →
Application Security 30 May 2026
Django SQL Injection via FilteredRelation: CVE-2025-13372
Critical Django SQL injection vulnerability through FilteredRelation dictionary expansion on PostgreSQL databases.
Read more →
Application Security 30 May 2026
Django User Enumeration via Timing Attack: CVE-2024-39329
Django authentication vulnerability allows user enumeration through timing differences in password validation.
Read more →
Application Security 30 May 2026
Laravel CVE-2024-52301: Environment Manipulation Vulnerability
Critical Laravel vulnerability allows environment manipulation through crafted query strings when register_argc_argv is enabled.
Read more →
Application Security 30 May 2026
Express.js Body Parser Denial of Service: CVE-2024-45590
High-severity Express.js body-parser vulnerability allows denial of service attacks through crafted URL-encoded payloads.
Read more →