Why SBOM generation is just the first step in software supply chain security Software bills of materials (SBOMs) have quickly become an essential component of software supply chain security. Regulators, customers, and security leaders increasingly expect organizations to understand the components included within their…
Every security team in every organization that builds software is grappling with the same problem: The vulnerability backlog. It’s out of control. This is being driven both by the dramatic increase in code (much of it AI generated) as well as the flood of newly disclosed CVEs (fueled by increased testing of open…
For years, application security operated on a relatively predictable cadence. Vulnerabilities were disclosed, teams triaged them by severity, and the critical ones were fixed first. But with the advances of AI, most notably Anthropic’s Claude Mythos , that world is gone. Code volume is exploding as teams use AI to…
What php2shell is and why it matters If you run PHP, upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. The hard part is finding every place PHP actually runs. php2shell is a pair of critical flaws in the PHP interpreter, tracked as CVE-2026-109618 and CVE-2026-109619. Both are use-after-free bugs that can let an…
What does it take to secure an application end to end? Source code, yes. But also the container images and binaries that carry hidden dependencies, and the AI frameworks your developers are already building with. As your application security program grows across more repositories, pipelines, and environments, you need…
Fuzz testing is now a team sport Security teams don’t fuzz test in isolation. QA engineers, security teams, protocol experts, and CI/CD pipelines all contribute to the process. Until now, collaborating through a shared Black Duck Defensics® environment, sharing test configurations, and gaining visibility into results…
“You’re not going to lose your job to an AI, but you’re going to lose your job to someone who uses AI,” Jensen Huang , Founder and CEO at Nvidia. Any human work that involves computers is a candidate for automation with AI. Software analysis is no exception, and LLMs can augment software composition analysis (SCA) and…
As development teams adopt AI-generated code and manage security across more repositories and workflows, keeping everything connected can become increasingly challenging. Scan configurations can drift over time, dependency risk can change between scans, and security activities often span multiple tools and…
Free penetration testing tools help security professionals discover vulnerabilities, validate exploitability, analyze attack paths, and assess whether security controls can withstand real-world threats. Some tools specialize in network reconnaissance, while others focus on web applications, APIs, databases,…
As organizations race to adopt AI across software development and security, the pressure to move fast is colliding with the mandate to stay economical, repeatable, and defensible. The biggest risk isn’t adopting too slowly. It’s scaling without understanding the true cost of AI. Prefer to listen or watch? Check out…