Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Last month, the FBI arrested a suspect in its ongoing response to an attack on its job portal, allegedly carried out by criminal hacker and extortion group ShinyHunters. The agency said a contractor failed to apply a security patch to a third-party platform involved in the breach of its job portal, while Reuters reported that the contractor worked for Accenture and that the platform was Oracle PeopleSoft. (Fair warning: The Reuters article is behind a paywall.)

Every security team is being told to adopt AI. Far fewer have been shown what "good" looks like in practice. Turnkey agents handle common, well-defined security tasks, but no two security teams operate the same way. Each has its own data, playbooks, escalation paths, and risk tolerances; unique context that no vendor can anticipate in a packaged solution.

Spend any time with senior infrastructure and IT leaders right now and one conversation keeps coming up. The business wants AI, and increasingly it wants agentic AI: systems that don’t just recommend an action but take it. Boards have seen the productivity numbers. Competitors are announcing pilots. The pressure to move is real. At the same time, those same leaders own the risk register. They answer to regulators, auditors, and, when something goes wrong, the front page.

Cloud applications are constantly evolving to accommodate new users, tools, and ways of working. However, every adjustment can also alter who has access to resources and what they can do with them. A misconfiguration occurs when an active setting fails to meet established security criteria. It can grant more access than necessary, keep an insecure protocol enabled, allow certain actions for too many users, or open a pathway for information to leave the organization.

The Homegrown Agent Maturity Model for Execution & Risk (HAMMER): is a five-level framework with seven domains for security teams to locate where they stand on securing homegrown agents, then make the case for what they need to advance. The most powerful AI agents in your enterprise may be ones you never bought. Your own teams are building them by wiring models, tools, and data into software that acts on its own, often with little security approval or oversight.

Vibe-coding platforms let you go from prompt to a deployed app in a single session, a pace that outpaces the review cycles most teams built for slower releases. With Lovable nearing 8 million users by late 2025, and Replit past 50 million by April 2026, we wanted to answer a sharper question than “is vibe coding safe?” Does the platform generating the code change the outcome, and does one security prompt give you the same security everywhere?

A compromised laptop may have started the Binance hack. What can an attacker reach from a developer’s machine?

GitGuardian now sends leaked secrets from GitHub, GitLab, Bitbucket, and Azure DevOps to Wiz once a day, with validity, severity, and a link back to the incident. Your cloud and AppSec teams see the same leaked key, and the secret value never leaves GitGuardian.

A new report from TransUnion has found that 81% of digital fraud attacks target existing customer relationships, with more than half of U.S. businesses reporting increased scam and fraud activity over the past year.

Last week we moved every certificate in one of our products to a new CA in 10 minutes. It was six certificates and 18 deployments. I said issuance was the part that slows down, because most CAs limit how fast you can order, and then I waved it off. A reader did the math for me. Some organizations run 30,000 certificates, they claimed, and that’s common at MSPs, telcos, and government agencies. Google Trust Services takes 100 orders an hour by default.