# Application Security Published articles for Application Security. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts DevFeed: [When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts]() Original publisher: [Read original article]() Author: Denzil Correa Published: 2026-09-16T20:06:17Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [Cloudflare](), [Machine Learning, Security Attacks](), [Security](), [JavaScript]() Tags: [ai](), [application-security](), [attacks](), [client-side-security](), [cloudflare](), [cybersecurity](), [developer-platform](), [developers](), [ecommerce](), [javascript](), [machine-learning](), [malicious-javascript](), [page-shield](), [security](), [security-research](), [virustotal](), [workers-ai]() ### AI overview Cloudflare describes how its Client-Side Security machine learning model detected four malicious JavaScript operations involving eight payloads in live storefront traffic. The post says humans verified the findings after automated detection, while most payloads were absent from VirusTotal and received no malicious verdict from URLScan. ### Source excerpt A modern storefront can look healthy while malicious JavaScript quietly siphons revenue, hijacks clicks, or rewrites analytics. See how Cloudflare's machine learning models surface evasive client-side attacks for analyst investigation. ## Java 27 Delivers Post-Quantum Cryptography, Future Language Innovation, Helidon 27, JavaFX 27 DevFeed: [Java 27 Delivers Post-Quantum Cryptography, Future Language Innovation, Helidon 27, JavaFX 27]() Original publisher: [Read original article]() Author: Michael Redlich Published: 2026-09-16T10:00:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [Java](), [java-27](), [Post-quantum cryptography](), [Cryptography](), [Security](), [Programming](), [releases]() Tags: [application-security](), [architecture-design](), [cryptography](), [development](), [digital-signature](), [helidon](), [java](), [java-27](), [java27-released](), [javafx](), [jdk-27](), [jdk-28](), [lattice](), [module](), [news](), [oracle](), [portfolio](), [post-quantum-cryptography](), [preview](), [project-valhalla](), [quantum-computing](), [release](), [security](), [structured-concurrency](), [vector]() ### AI overview Oracle released Java 27, the second non-LTS release since JDK 25. Its final feature set contains nine JEPs, including post-quantum hybrid key exchange for TLS 1.3, structured concurrency, compact object headers, JFR data redaction, the Vector API, and PEM encodings for cryptographic objects. Five features remain in preview or incubator stages. ### Source excerpt Oracle has released version 27 of the Java programming language and virtual machine. As the second non-LTS release since JDK 25, the final feature set includes nine JEPs, five of which are still progressing through the preview and incubator stages. This release focuses on strengthening security, future language innovation, and projects under the auspices of the Java Verified Portfolio. By Michael Redlich ## When to use SAST versus an LLM security scanner DevFeed: [When to use SAST versus an LLM security scanner]() Original publisher: [Read original article]() Author: Chris Widstrom Published: 2026-09-16T00:00:00Z Content type: comparison Language: en Sources: [GitLab]() Topics: [Security](), [LLM security](), [Large Language Model](), [Application Security](), [Testing](), [Frontier Model](), [audit trail](), [business logic]() Tags: [application-security](), [audit-trail](), [features](), [frontier-model](), [llm](), [llm-security](), [product](), [sast](), [security](), [vulnerabilities]() ### AI overview This comparison explains when to use static application security testing (SAST) and when to use LLM-based security review. SAST provides predictable, repeatable, low-cost scanning across commits, while LLMs can reason about context and identify some intent-based or novel issues. The article recommends using both according to the task and scan scope. ### Source excerpt You're probably running some version of this experiment already: Point a frontier model at a merge request and ask it to double as a vulnerability scanner. On a single merge request, it often works well. The model reads the code, reasons about what it's supposed to do, and catches real issues, sometimes ones a pattern-based scanner misses entirely. So the next thought is reasonable: If a model reviews one merge request this well, why not let it replace the scanner across your whole pipeline? That's where it breaks down. Running a frontier model as your primary scanner on every commit across an enterprise codebase costs more and behaves less predictably, than asking it to review one merge request. If you run application security for a platform or product team, the decision was never mutually exclusive: static application security testing (SAST) or LLM scanners. It's which one runs where. Get that split right and you keep deterministic coverage on every commit, add reasoning where it earns its place, and avoid both an unpredictable inference bill and gaps in your audit trail. Here's how the two compare: Deterministic scanner (SAST)AI-based review (LLM)CostBetter Fractions of a cent per scan, fixed and predictable. A paid inference call per scan; cost scales with code volume and is hard to forecast.ConsistencyBetter Flags the same vulnerabilities, every time. Can flag or miss different vulnerabilities on the same code, run to run.Audit evidenceBetter Reproducible: same fixed method every time, mapped to a CWE Output can vary between runs, harder to use as standalone audit evidence.Vulnerability typesDepends on the vulnerability type Pattern-based, traceable flaws (injection)Depends on the vulnerability type Intent-based and novel flaws: missing auth checks, broken ownership logic, and issues not yet mapped to a CVE or CWE. Could reason about business logic using context from issues, epics, and docs.Validating a finding Flags potential vulnerabilities; can't confirm whe ## The AI Hurricane Is Here DevFeed: [The AI Hurricane Is Here]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2026-09-15T04:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Artificial Intelligence](), [AI Development](), [Security](), [Vulnerabilities](), [Architecture & Design](), [audit trail]() Tags: [agentic-development](), [agents](), [ai](), [application-security](), [audit-trail](), [awareness](), [blog](), [code-security](), [developer](), [executive](), [security](), [security-labs](), [snyk-platform](), [snyk-security-intel](), [supply-chain-security](), [tech](), [validation](), [vulnerabilities](), [vulnerability-insights]() ### AI overview The article argues that AI is accelerating software creation and cyberattacks, widening the gap between machine-speed development and slower validation. It calls for securing agentic development, enforcing runtime controls, maintaining inventories and audit trails for production AI applications, and using independent validation. ### Source excerpt AI is accelerating software creation and cyberattacks alike. Leaders must secure agents and code at inception, enforce controls at runtime, and validate defenses independently. ## How to Catch Security Vulnerabilities in Code Before They Reach Your Pull Requests DevFeed: [How to Catch Security Vulnerabilities in Code Before They Reach Your Pull Requests]() Original publisher: [Read original article]() Author: Umair Mirza Published: 2026-09-14T22:23:01Z Content type: tutorial Language: en Sources: [freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More]() Topics: [Application Security](), [Security](), [Vulnerabilities](), [Secret Scanning](), [Git](), [pull-requests](), [ci](), [Command-line interface](), [.NET](), [Python](), [coding]() Tags: [application-security](), [ci](), [cli](), [code](), [devsecops](), [git](), [net](), [pull-requests](), [python](), [sast](), [secret-scanning](), [security](), [security-vulnerabilities](), [software-development](), [testing](), [vulnerabilities]() ### AI overview This tutorial explains how to shift security checks earlier in development by running SAST locally with Git pre-commit hooks. It demonstrates using the DevSkim CLI to detect insecure coding patterns, pairing it with Gitleaks for dedicated secret scanning, validating the setup with an intentional failure, and enforcing the checks in CI. ### Source excerpt Security reviews are most effective when developers receive feedback while the code is still fresh in their minds. Waiting until a pull request, CI build, or penetration test to find exposed credentia ## Is prevention essentially a solved problem? DevFeed: [Is prevention essentially a solved problem?]() Original publisher: [Read original article]() Author: Ezra Tanzer Published: 2026-09-10T04:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [AI Development](), [Vulnerabilities](), [Architecture & Design](), [Code]() Tags: [agent](), [agentic](), [ai](), [application-security](), [awareness](), [blog](), [code](), [code-security](), [cost](), [developer](), [devops](), [devsecops](), [secrets](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [vulnerabilities](), [vulnerability-insights]() ### AI overview The article argues that preventing vulnerabilities in agent-generated code is architecturally understood, but organizations must apply the appropriate controls throughout a changing development lifecycle. It says prompts can influence code but cannot reliably constrain agents, and that earlier security intervention reduces model-token cost, human attention, and the risk of an incorrect fix. ### Source excerpt Prevention in agent-generated code is architecturally solved--but choosing controls that protect security without slowing development remains the challenge. ## Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting) DevFeed: [Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)]() Original publisher: [Read original article]() Author: Alex Krivit Published: 2026-09-08T13:10:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Cryptography](), [SSL](), [Latency](), [Encryption]() Tags: [application-security](), [application-services](), [cloudflare](), [encryption](), [latency](), [performance](), [post-quantum](), [research](), [ssl](), [tls]() ### AI overview Cloudflare announces Automatic Key Exchange, which probes TLS 1.3 origins for supported key-agreement algorithms and uses the preferred option on the first connection attempt. The rollout reduces HelloRetryRequests and handshake latency while automatically preferring post-quantum hybrid connections where supported. ### Source excerpt Automatic Key Exchange probes TLS 1.3-capable customer origins to learn which key agreement algorithms they support. We then lead with the most secure algorithm when connecting to the origin, preferring post-quantum connections wherever the origin supports it. ## MAST in the Age of Open Source Software |Guardsquare DevFeed: [MAST in the Age of Open Source Software |Guardsquare]() Original publisher: [Read original article]() Author: Simon Haven - Product Marketing Manager Published: 2026-09-01T10:59:01Z Content type: article Language: en Sources: [Guardsquare Blog]() Topics: [Open Source](), [Mobile Security](), [Application Security](), [Vulnerabilities](), [Social engineering](), [npm]() Tags: [app-security-testing](), [application-security](), [appsweep](), [general](), [malware](), [mobile](), [mobile-apps](), [npm](), [open-source](), [open-source-software](), [social-engineering](), [supply-chain](), [vulnerabilities]() ### AI overview This article explains why mobile application security testing is important when apps use free and open source software. It describes how vulnerable, deprecated, compromised, and transitive third-party dependencies can expand an app's attack surface, citing a September 2025 npm supply chain attack as an example. ### Source excerpt Building with free and open source software (FOSS) has become common practice for app developers. In 2022, it was estimated that between 70% and 90% of any given software codebase was made up of open source components. Leveraging open source projects presents many advantages: ## Introducing Adaptive Intelligence: Undermining the economics of every bot attack DevFeed: [Introducing Adaptive Intelligence: Undermining the economics of every bot attack]() Original publisher: [Read original article]() Author: Chris Pope Published: 2026-08-31T12:59:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Bot](), [Artificial Intelligence](), [Cloudflare](), [Network](), [releases]() Tags: [ai](), [application-security](), [attacks](), [bot-management](), [cloudflare](), [machine-learning](), [network](), [product-news](), [releases]() ### AI overview Cloudflare introduces Adaptive Intelligence, a bot detection engine designed to undermine the economics of automated attacks. It responds to attackers' changing tactics by learning from live traffic and making attacks slower and more costly to sustain. ### Source excerpt Bot operators have historically had the economic advantage, bypassing static, deterministic detection rules with cheap proxies and retooling. Cloudflare's new Adaptive Intelligence engine flips this dynamic by autonomously learning from the meta-signals of live traffic and deploying disposable rules, making automated attacks too expensive to sustain. ## BotBase for Operators: A clearer path to joining Cloudflare's directory of bots and agents DevFeed: [BotBase for Operators: A clearer path to joining Cloudflare's directory of bots and agents]() Original publisher: [Read original article]() Author: Julian Laxman Published: 2026-08-28T12:59:44Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [AI Bots]() Tags: [agents](), [ai-bots](), [application-security](), [bot-management](), [bots](), [cloudflare](), [content](), [model](), [update]() ### AI overview Cloudflare launched BotBase for Operators, adding a dashboard area where bot operators can browse the directory, submit bots, and track submission history. The update also provides submission-status visibility, editing, and a behavior model for declaring content use. ### Source excerpt Bot operators now have a home in the Cloudflare dashboard to manage submissions. This update adds submission status tracking, submission editing, and a behavior model so operators can accurately declare how their bots use content. ## GitLab compliance frameworks: Adhere to SOC 2 in minutes DevFeed: [GitLab compliance frameworks: Adhere to SOC 2 in minutes]() Original publisher: [Read original article]() Author: Fernando Diaz Published: 2026-08-27T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [GitLab](), [Template](), [configuration](), [Security](), [Software]() Tags: [application-security](), [article](), [compliance](), [devsecops](), [framework](), [how-to](), [platform](), [security](), [soc](), [software](), [software-delivery](), [tutorial]() ### AI overview This article explains how GitLab custom compliance framework templates help teams define controls, continuously monitor adherence, and prepare for audits. It uses SOC 2 as a central example and covers templates, policies, compliance requirements, and automated checks across GitLab deployment options. ### Source excerpt Compliance is the part of software delivery that everyone agrees is important, yet nobody enjoys. It often lives in spreadsheets, screenshots, and the quiet dread of an upcoming audit. GitLab's custom compliance frameworks work differently. Instead of documenting what should be true about your projects, you define the controls once and let the platform continuously verify what is true. In this article, you'll learn why compliance adherence matters, how to stand up a SOC 2 framework in minutes using a template, how to monitor adherence on an ongoing basis, how to enforce compliance with policies, and which standards already ship as ready-to-use templates. You'll also get a look at where AI-specific compliance templates are heading. You can watch the video below to see it in action: Tier note: Compliance frameworks are available in Premium and Ultimate. Framework requirements and controls, the checks that power adherence reporting and the compliance status report, require Ultimate. Everything here applies to GitLab.com, GitLab Self-Managed, and GitLab Dedicated. Why compliance adherence matters and how custom frameworks help Regulatory and contractual obligations like SOC 2, ISO 27001, PCI DSS, and FedRAMP exist because customers, partners, and regulators need assurance that your software is built and shipped responsibly. Falling short isn't just a paperwork problem. It can block deals, trigger fines, delay product launches, and erode trust. Compliance also isn't a one-time event. A project that was compliant at audit time can drift the moment someone disables a scanner, removes branch protection, or merges without the required approvals. Custom compliance frameworks are designed to close that gap. A compliance framework in GitLab is a label you create on a top-level group to identify projects that carry specific compliance obligations or need extra oversight. On its own that label provides organization and visibility. In Ultimate, a framework can also carry requireme ## Why Your AI Application Is Exposed DevFeed: [Why Your AI Application Is Exposed]() Original publisher: [Read original article]() Author: Damian Tommasino Published: 2026-08-26T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [AI Development](), [Large Language Model](), [vulnerability](), [Model Context Protocol](), [Retrieval Augmented Generation (RAG)](), [Machine Learning, Security Attacks](), [data]() Tags: [ai](), [ai-red-team](), [application-security](), [awareness](), [blog](), [devops](), [executive](), [interest](), [llm](), [mcp](), [rag](), [security](), [testing](), [vulnerability]() ### AI overview The article explains why AI applications can pass conventional security scans and model evaluations while remaining exploitable through chained interactions among prompts, language models, retrieval, tools, and backend workflows. It presents DAST, AI penetration testing, and AI red teaming as complementary lenses for identifying exposed surfaces, exploitable paths, and real-world adversary outcomes. ### Source excerpt AI applications can pass security scans yet remain exploitable through chained attacks across models, tools, data, and business workflows. Learn how DAST, AI pentesting, and red teaming work together to expose end-to-end risk. ## Detect vulnerabilities in LLM applications with Datadog's AI-native SAST DevFeed: [Detect vulnerabilities in LLM applications with Datadog's AI-native SAST]() Original publisher: [Read original article]() Author: Jon Green; Bahar Shah Published: 2026-08-20T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [Vulnerabilities](), [Application Security](), [AI, ML & Data Engineering](), [ci]() Tags: [ai](), [ai-security](), [application-security](), [applications](), [ci](), [code-security](), [llm](), [security](), [threat-detection](), [vulnerabilities]() ### AI overview Datadog describes an AI-native SAST capability for finding LLM-specific application vulnerabilities, including prompt injection, excessive agency, and hidden-context exposure. It uses code context and data-flow reasoning, verifies findings, and surfaces results in pull requests and CI checks. ### Source excerpt Datadog Code Security's AI-native SAST helps detect vulnerabilities specific to the OWASP Top 10 for LLM Applications before they reach production. ## When your backlog outgrows your team, GitLab scales remediation DevFeed: [When your backlog outgrows your team, GitLab scales remediation]() Original publisher: [Read original article]() Author: Alisa Ho Published: 2026-08-20T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [GitLab](), [Application Security](), [Vulnerabilities](), [Security](), [Artificial Intelligence]() Tags: [agentic](), [ai](), [application-security](), [developer](), [features](), [product](), [security](), [vulnerabilities]() ### AI overview GitLab 19.3 introduces bulk SAST False Positive Detection and Agentic SAST Vulnerability Resolution for existing production vulnerability backlogs. The features assess findings, identify likely false positives, and generate ready-to-merge fixes for confirmed vulnerabilities, including findings imported from third-party SARIF scanners. ### Source excerpt Security teams have historically struggled to keep up with triage and remediation when development was happening at human speed. Today, that challenge is exacerbated by developers writing and shipping code at machine speed with AI. At the same time, AI is helping attackers find and exploit vulnerabilities faster in production. Verizon's 2026 Data Breach Investigations Report found vulnerability exploitation overtook credential abuse as the top breach entry point. Vulnerability exploitation accounts for 31% of breaches versus just 13% in previous years, and only 26% of known exploited vulnerabilities were remediated this year, down from 38%. That means more breaches are starting with a vulnerability that was already sitting in production, unpatched. In GitLab 19.3, teams can now run Static Application Security Testing (SAST) False Positive Detection and Agentic SAST Vulnerability Resolution, in bulk, on their existing vulnerability backlog. Dismiss false positives and remediate vulnerabilities in bulk Most teams have a known vulnerabilities backlog already running in production, far more than any team has time to open and triage one at a time. That used to be a workload problem. Now it's a timing problem too: The same AI accelerating development is accelerating exploitation, which means findings that sit in the backlog longer carry more risk than they used to. GitLab addresses this with two layers of automated triage and remediation. The first covers active vulnerabilities in production. With GitLab 19.3, teams can bulk-select multiple vulnerabilities to run agentic flows, SAST False Positive Detection and Agentic SAST Vulnerability Resolution, against the vulnerability backlog in production. SAST False Positive Detection analyzes a finding's surrounding code and returns a confidence score and explanation for whether it's a real risk or a false positive. Agentic SAST Vulnerability Resolution takes findings confirmed as real risk and opens a ready-to-merge fix that re ## Putting models to the secure coding test: Plan vs default mode DevFeed: [Putting models to the secure coding test: Plan vs default mode]() Original publisher: [Read original article]() Author: Kennedy Toomey Published: 2026-08-19T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [AI-assisted coding](), [Application Security](), [code security](), [Code quality](), [Vulnerabilities](), [Claude](), [cursor](), [codex]() Tags: [application-security](), [claude](), [code-quality](), [code-security](), [codex](), [command-line](), [cursor](), [supply-chain](), [vulnerabilities]() ### AI overview This article describes an experiment comparing plan mode with default mode for secure code generation. The author tested Sonnet 5, Composer 2.5, and GPT 5.5 through Claude, Cursor, and Codex, using security and code-quality analysis to assess the results. ### Source excerpt We tested Sonnet 5, Composer 2.5, and GPT 5.5 in plan mode and default mode to see whether plan mode produces measurably more secure code. ## Remediation Agents, Demystified: Why Fixing Beats Finding DevFeed: [Remediation Agents, Demystified: Why Fixing Beats Finding]() Original publisher: [Read original article]() Author: Snyk Team Published: 2026-08-19T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [Vulnerabilities](), [AI-assisted coding](), [pull-requests](), [Responsibility & Safety](), [Artificial Intelligence]() Tags: [agentic](), [ai](), [ai-agents](), [application-security](), [aspm](), [awareness](), [ci-cd](), [code-security](), [community](), [developer](), [devops](), [devsecops](), [enablement](), [interest](), [javascript](), [live-stream](), [node-js](), [pull-requests](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [validation](), [vs-code](), [vulnerabilities]() ### AI overview Snyk's Remediation Agent is presented as a public-preview solution for the growing security-issue backlog. The article explains how coding agents can increase vulnerabilities, why deterministic remediation advice has not been enough, and how validation helps turn fixes into mergeable pull requests. ### Source excerpt See how Snyk's Remediation Agent uses security intelligence, breakability analysis, and validation to turn vulnerabilities into mergeable pull requests. ## The Agent Baseline: 35 Controls, But Where Should You Start? DevFeed: [The Agent Baseline: 35 Controls, But Where Should You Start?]() Original publisher: [Read original article]() Author: Krysztof Huszcza; Ezra Tanzer Published: 2026-08-12T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Securing AI](), [Architecture & Design](), [Artificial Intelligence]() Tags: [agent](), [agents](), [ai](), [ai-agents](), [application-security](), [architecture](), [black-hat](), [blog](), [coding](), [devops](), [docker](), [enablement](), [production](), [security]() ### AI overview The Agent Baseline presents six security outcomes, 35 controls, and an open reference architecture for running AI agents at enterprise scale. It addresses how organizations can decide where to begin, identify gaps, and sequence controls across coding, internal, and production agent use cases. ### Source excerpt The Agent Baseline defines 35 controls across six security outcomes--but the right starting point depends on how your organization uses agents. Learn how to sequence controls for coding, internal, and production agents. ## How Mobile App Security from Guardsquare Addresses Gaps in Framework Compliance DevFeed: [How Mobile App Security from Guardsquare Addresses Gaps in Framework Compliance]() Original publisher: [Read original article]() Author: Guest post by Dr. Edward Amoroso, CEO, TAG Infosphere Inc. and former AT&T Chief Security Officer Published: 2026-08-11T14:00:31Z Content type: opinion Language: en Sources: [Guardsquare Blog]() Topics: [Mobile Security](), [Application Security](), [Security](), [Cybersecurity](), [Artificial Intelligence]() Tags: [application-security](), [compliance](), [credentials](), [cybersecurity](), [frameworks](), [governance](), [hardening](), [mobile](), [protection](), [regulatory](), [report](), [security](), [standards]() ### AI overview A featured guest post examines how mobile application security, including Guardsquare's hardening, runtime protection, and anti-tampering capabilities, can help enterprises address gaps in compliance frameworks. It also argues that frameworks such as NIST CSF 2.0 should more explicitly account for mobile app risk. ### Source excerpt Former AT&T Chief Security Officer and TAG Infosphere founder Dr. Edward Amoroso shares his perspective on the state of mobile application security in a featured guest post for Guardsquare. Enterprise compliance is evolving as organizations face mounting regulatory pressure and more capable threat actors. Regulators now expect alignment to frameworks such as National Institute of Standards and Technology Cybersecurity Framework (CSF) 2.0 and sector-specific mandates. Yet, while governance has matured around cloud, endpoint, and networks, mobile app risk remains underrepresented in compliance frameworks and control processes. ## Show, Don't Tell: What Evo Continuous Offensive Security Found in a Real Enterprise SaaS DevFeed: [Show, Don't Tell: What Evo Continuous Offensive Security Found in a Real Enterprise SaaS]() Original publisher: [Read original article]() Author: Nuno Loureiro; Luis Grangeia Published: 2026-08-10T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Vulnerabilities](), [Authorization](), [Software as a service](), [Microservice](), [Microservices](), [Front end](), [API](), [App](), [Artificial Intelligence](), [Trustworthy AI]() Tags: [agent](), [ai](), [api](), [application-security](), [applications](), [attacks](), [autonomous](), [awareness](), [blog](), [customer](), [customer-featured](), [cybersecurity](), [devops](), [enterprise](), [frontend](), [interest](), [microservices](), [saas](), [security](), [vulnerabilities](), [vulnerability-insights](), [web]() ### AI overview Evo Continuous Offensive Security (COS) is presented as an autonomous offensive-security system combining AI pentesting, agent red teaming, and dynamic testing. The article reports a real assessment of a multi-tenant enterprise SaaS application that uncovered 33 confirmed vulnerabilities, including tenant-wide compromise and critical authorization flaws. ### Source excerpt A real Evo Continuous Offensive Security assessment uncovered 33 confirmed vulnerabilities in a multi-tenant enterprise SaaS, including tenant-wide compromise and critical authorization flaws. ## How to let AI agents act on behalf of users without handing them access tokens DevFeed: [How to let AI agents act on behalf of users without handing them access tokens]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-10T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [OAuth](), [Artificial Intelligence](), [Application Security](), [Security]() Tags: [ai](), [ai-agents](), [application-security](), [logging](), [oauth](), [observability](), [security]() ### AI overview This article explains why giving AI agents long-lived OAuth access tokens creates security risks. It describes how untrusted content can influence agent behavior and cause tokens to appear in context windows, tool-call logs, model-provider logs, and other unintended locations. ### Source excerpt Agents that call third-party APIs on behalf of users normally hold the OAuth access token. Here is where that token leaks, and how to get delegated access without it. ## A few notes on AWS Nitro Enclaves: KMS integration DevFeed: [A few notes on AWS Nitro Enclaves: KMS integration]() Original publisher: [Read original article]() Author: "Paweł Płatek" Published: 2026-08-05T11:00:00Z Content type: article Language: en Sources: [The Trail of Bits Blog](), [The Trail of Bits Blog]() Topics: [Cryptography](), [AWS IAM]() Tags: [application-security](), [aws](), [cryptographic](), [cryptography](), [encryption](), [iam](), [integration](), [policy](), [trusted-execution-environment]() ### AI overview The article examines security and operational risks in integrating AWS Nitro Enclaves with KMS, including attestation, key policies, and encrypted key handling. ### Source excerpt Nitro Enclaves and Key Management Service (KMS) feel like a natural fit: since the KMS can verify attestation documents generated by the enclaves, developers can offload key management tasks from their applications to the AWS-managed service. But integrating an external service with your trusted enclaves comes with new threats, even if that service comes from the same provider. In this blog post--the third in our series on Nitro Enclaves, following our posts on attack surface and images and attestation--we catalog passive and active attack classes against the enclave-KMS communication channel, and cover the operational risks that persist even when the cryptography is correct. Intro to KMS The KMS is an AWS service that provides a unified public API for creating and managing keys backed by HSMs to the broader AWS ecosystem. There are three main key types supported by KMS that devs need to care about: Customer-managed keys (CMK) Data keys (DK, symmetric) Data key pairs (asymmetric) CMKs never leave KMS. You request KMS to perform cryptographic operations (like encryption or signing) for you. Data keys and key pairs are generated in KMS, are not stored in KMS, and are intended for programmatic uses. For symmetric keys, the KMS gives you a plaintext key and the same key encrypted to CMK. Your application performs encryptions, removes the plaintext key, and stores the key encrypted to a CMK along the ciphertexts; this pattern is called envelope encryption. For asymmetric keys, the KMS gives you a plaintext key pair and the private key encrypted to CMK. Your application creates signatures or encrypts data, deletes the private key, and keeps the public key and encrypted private key (along with signatures/ciphertexts). Both types of data keys can be used with Decrypt operation to get plaintext keys again. S t o r a g e s t { o E r _ e d ( k E , _ C d } k , C ) E n c l a v G e e { n d e k C D p r , = e l a E e c a t _ n r i e d c y n D k ( p t a = d t e t e k ( { x a n , c d t ## Continuous Offensive Security & AI Pentesting: 20 FAQs DevFeed: [Continuous Offensive Security & AI Pentesting: 20 FAQs]() Original publisher: [Read original article]() Author: Snyk Team Published: 2026-08-05T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security]() Tags: [agentic](), [agents](), [ai](), [ai-agents](), [apis](), [application-security](), [awareness](), [blog](), [cos](), [event-driven](), [security](), [snyk-platform](), [testing](), [validation](), [vulnerability]() ### AI overview An FAQ-style article on continuous offensive security, combining recurring and event-driven testing with DAST, AI penetration testing, and AI red teaming to identify and validate application risk as applications change. ### Source excerpt Get answers to 20 common questions about continuous offensive security, AI penetration testing, DAST, and AI red teaming. ## AI SAST: Challenges for Application Security Teams DevFeed: [AI SAST: Challenges for Application Security Teams]() Original publisher: [Read original article]() Author: Nicole Morgan Published: 2026-08-05T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [Application Security](), [Artificial Intelligence](), [AI Development](), [software composition analysis]() Tags: [ai](), [ai-coding](), [application-security](), [sast](), [sca](), [vulnerabilities]() ### AI overview This article discusses how AI-assisted development increases pressure on static application security testing (SAST) programs. It identifies false positives, vulnerability backlogs, low remediation rates, and limited pipeline coverage as obstacles to helping developers address findings quickly. ### Source excerpt Learn how AI is transforming SAST, reducing security friction, and helping teams secure AI-generated code without slowing delivery. | Blog ## A First Look at Evo Agentic AppSec: Agentic Remediation and Malicious Code Defense DevFeed: [A First Look at Evo Agentic AppSec: Agentic Remediation and Malicious Code Defense]() Original publisher: [Read original article]() Author: Brendan Hann Published: 2026-08-04T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [AI Bots]() Tags: [agent](), [agentic](), [ai](), [ai-agents](), [ai-security](), [application-security](), [aspm](), [autonomous](), [blog](), [cli](), [code-security](), [developer](), [devops](), [interest](), [javascript](), [node-js](), [open-source-security](), [pull-request](), [python](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [vulnerabilities](), [vulnerability-insights]() ### AI overview Snyk introduces Evo Agentic AppSec capabilities for automatically remediating vulnerabilities and blocking malicious packages before they reach code. The Remediation Agent triages issues, creates and checks fixes, and opens pull requests for review. ### Source excerpt Explore Snyk's first Agentic AppSec capabilities: an autonomous Remediation Agent that fixes vulnerabilities and Malicious Code Defense that blocks risky packages before they ship. [Next page]()