AppSec
10 articles on AppSec.
-
Secure by Design
Runtime Security Boundaries Require Runtime Enforcement: Lessons from n8n's CVE Chain
n8n's five critical CVEs in 90 days share a single architectural flaw: TypeScript type annotations used as runtime security enforcement -- but TypeScript annotations don't exist at JavaScript runtime. The patch for the first CVE was bypassed by the same mechanism two months later. If you build AI agent pipelines or any sandbox with compile-time security constraints, this CVE chain names the failure directly.
-
ProductSecurity
What GRP-Obliteration Tells You About Your AI System's Threat Model
Microsoft researchers reversed LLM safety alignment across 15 models using a single adversarial training prompt. The attack exploits a fundamental design flaw: safety implemented as learned behavior can be inverted through training-based attacks. For product security teams deploying AI systems, the lesson is architectural - security properties must be enforced through system design, not statistical tendencies.
-
AppSec
Why Privileged Access Management Tools Must Be Designed to a Higher Security Standard Than the Systems They Protect
When a Privileged Access Management platform is the target, the blast radius is everything behind it. CVE-2026-1731, a CVSS 9.9 pre-authentication OS command injection in BeyondTrust Remote Support, went from public PoC to confirmed in-the-wild exploitation in under 24 hours -- exposing 8,500+ unpatched on-premises instances. This article dissects the PAM Platform Paradox and what it demands from product security architecture.
-
Secure by Design
Six Zero-Days in One Month: Microsoft February 2026 Patch Tuesday and the Systemic Failure of Security Feature Bypass Defenses
Microsoft February 2026 Patch Tuesday: six actively exploited zero-days, most bypassing SmartScreen and Mark of the Web. Systemic bypass analysis.
-
Secure by Design
When AI Agents Become Attack Surfaces: The Claude Desktop Extensions Remote Code Execution Vulnerability and Autonomous Tool Chaining Without Trust Boundaries
Remote code execution via Claude Desktop Extensions through calendar event injection. AI agents chaining tools without trust boundaries exposes everything.
-
AppSec
When MFA Becomes the Attack Surface: Synchronized Vishing, Real-Time Relay, and Authentication Trust Boundaries
Synchronized vishing attacks bypass MFA through real-time relay. The attacker calls the user and replays tokens before they expire. Architectural defenses.
-
Secure by Design
Shadow AI and the Machine Identity Governance Crisis: Why Most IAM Programs Weren't Designed for This
Shadow AI is an architectural failure in identity governance, not a policy problem. Most IAM programs were designed for humans, not autonomous AI agents.
-
AppSec
The Salesloft/Drift OAuth Breach: When Your SaaS Integrations Become Attack Vectors
The Salesloft/Drift OAuth breach compromised 700+ organizations through weaponized tokens. Six months of silent credential harvesting via SaaS-to-SaaS trust.
-
AppSec
Stop Treating LLM Agents as Trusted Users: Lessons from GitLab CVE-2021-39935
CISA added CVE-2021-39935 to the KEV catalog in February 2026. LLM agents with broad API access inherit every vulnerability in your attack surface.
-
AppSec
Don't Pipe URLs into Shell Scripts: Lessons from CVE-2026-1281
Ivanti EPMM zero-days CVE-2026-1281 and CVE-2026-1340 (CVSS 9.8) expose the danger of piping remote content into shell execution without validation.
