Browsing Category
Application Security
66 posts
Security Point Break covers application security threats, vulnerabilities and defenses across modern software development. Our reporting follows secure coding, API security, open-source risk, software supply chain attacks, vulnerability research, AppSec testing and the security challenges created by AI-generated code and development tools — with practical context for security and development teams.
The AI Kill-Switch Problem Is That There Is No Kill Switch
Everyone has an AI kill switch, but the buttons are wired to different parts of the machine. SPB maps the emerging stack of runtime, identity, policy, network and infrastructure controls.
The PHP2Shell Checklist: You’re Not Safe Until You’re Safe
Installing the emergency patch is the first step, not the finish line. Here are the places PHP2Shell can outlive a “patched” status — and what it takes to prove it is gone.
A Hidden Flaw in the Web’s Plumbing Set Off a Global Scramble
Two newly discovered weaknesses in PHP, a programming language that runs a large share of the world's websites, could let strangers take over web servers. A patch is out, but experts say installing it is only the beginning.
The Next Security Bet Isn’t New Tools. It’s Fixing the Old Ones
The business of fixing security basics is booming as AI finds old flaws faster than defenders can patch them. Reach Security just raised $50 million-plus to prove it.
ServiceNow Gives AI Agents a Passport and Borders
AI Passport gives autonomous agents a signed identity defining what they can access and do, then checks those permissions as they act across tools, MCP servers and enterprise systems.
UPDATE: Knockoff Android Phones Ship with Malware Linked to IPIDEA Botnet
SPB traced the phones’ proxy domains to IPIDEA. They’re sinkholed. The ad-fraud apps aren’t
LLMLeak Turns AI Chatbots Into Unwitting Data Smugglers
A new attack hides stolen passwords in error messages and gets AI chatbots to deliver them, no prompt injection required.
Official MCP Code Flaw Exposes AI’s Trust Gap
A flaw in the official MCP Python SDK let malicious servers hijack OAuth logins and capture access users had just approved.
NVIDIA’s Answer to Agents Gone Rogue: Don’t Trust the Agent, Fence It
NVIDIA’s OpenShell runtime and BlueField-based Sentry watchdog put controls outside the AI agent - arriving six days after Okta rallied AWS, Google Cloud and others behind a broader security blueprint.
OpenAI Image Leak is Latest of 8 AI Lab Agent Incidents
OpenAI disclosed incidents exposing user images to external services, adding to data safety concerns.