Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Every enterprise control framework assumes the entity that requests an action and the entity that approves it are different. Multi-agent workflows quietly dissolve that assumption. Three agents each holding modest, individually reasonable permissions can compose an action none of them was authorized to take, and no single permission grant looks wrong in a review. ‍ That is the distinguishing property of multi-agent systems rather than a harder version of single-agent risk.

Organizations preparing for the EU AI Act keep asking which standard to certify against, and the honest answer is that the ones that will matter are not finished. No harmonized standard has been cited in the Official Journal, and nothing available today confers presumption of conformity with the Act's requirements for high-risk systems. ‍

Your security stack is a set of specialists, each guarding one territory. Exposed credentials don't respect the boundaries between them, and 64% of the ones found valid in 2022 were still valid four years later.

We benchmarked how well leading models produce vulnerability fixes that are both secure and functional, across ~150 real vulnerable code samples in JavaScript, Java, and Python. We ran each model on its own and with Snyk Intelligence (the new agentic Agent Fix architecture). The headline findings.

Route leaks push traffic down paths it was never meant to take. We have written and spoken publicly in the past about route leaks in Border Gateway Protocol (BGP), depicting these events as impactful incidents that cause misdirection of traffic through unintended network paths. BGP routing is driven by the relationships between Autonomous Systems (ASes), i.e., customer-provider and peer-peer.

You’re probably running a TLS configuration that the IETF says is “non-conformant”. But you didn’t do anything wrong. In July, the IETF published a pair of RFCs that took away three of TLS 1.2’s key exchange methods and froze the rest of it. The phrase they used is MUST NOT, the strongest thing a specification is allowed to say. Nginx, Apache, and Windows Server all ship with those key exchanges turned on by default. Nothing breaks tomorrow.

Bitsight TRACE has been actively monitoring the Aisuru botnet since February 2026. Through our dedicated infrastructure, we have observed the specific commands issued to the botnet and operational patterns orchestrated by the botnet's operators.

CVE-2026-19478 is a code injection vulnerability in GitLab Community Edition and Enterprise Edition, caused by improper handling of a GraphQL directive in the application’s API layer. GitLab disclosed the issue and shipped fixes in an ad hoc critical patch release on August 17, 2026, outside its normal twice-monthly security schedule. The vulnerability carries a CVSS base score of 9.4 (Critical) as assigned by GitLab. Exploitation requires no authentication and no user interaction.

An unauthenticated SQL injection vulnerability exists in the jsonArrayContains filter function in GeoTools, the geospatial library that underpins GeoServer. When an OGC filter is evaluated against a PostGIS data store, the value passed to jsonArrayContains is written into the generated SQL statement without escaping, allowing an attacker to alter the query the database executes.

Researchers at Microsoft warn that phishing emails are still the top initial access vector, with more than 2 billion phishing threats detected each month during the second quarter of 2026.