Lovable Left Thousands of Projects Exposed for 48 Days — And Still Hasn't Fixed It
The vibe-coding platform Lovable.dev is sitting on a ticking data exposure bomb — and it's been ticking for 48 days. A security researcher going …
Posts
Vercel Hacked Through an AI Tool — And Your Google Workspace Could Be Next
A third-party AI tool trusted by a single Vercel employee turned into the entry point for one of the most closely-watched cloud infrastructure breach…
The 7 Best Demostack Competitors for SaaS Teams That Need Faster Presales
Canadian software companies may be enjoying record investment, but their revenue teams are feeling the squeeze. Longer buying committees, tighter hea…
Microsoft's April Patch Breaks Its Own Security Feature — Domain Controllers Are Stuck in Reboot Loops
There is a bitter irony in a security patch disabling the very infrastructure that enterprise security runs on — but that is exactly what Microsoft&#…
Anthropic's MCP Design Flaw Enables Remote Code Execution Across 200,000+ AI Servers
A single architectural decision baked into Anthropic's Model Context Protocol has quietly turned the backbone of the AI agent ecosystem into a re…
How to Choose an ERP Consultant Without Creating Security Blind Spots
ERP projects are often described as technology initiatives. In reality, they are business-wide trust exercises. The moment a company starts replacing…
7 Best AI-Powered Identity Verification Providers in 2026
AI-powered identity verification has become one of the most important layers in digital trust. It is no longer just a compliance step used to satisfy…
Cloudflare Mesh Wants to Replace Your VPN — and It's Built for AI Agents, Not Just Humans
The way teams think about private network access has quietly changed. A year ago, the things knocking on your internal APIs were your developers and …
PHP Composer Hit by Two Command Injection Flaws That Work Even Without Perforce Installed
If you use PHP's Composer package manager, stop what you're doing and run composer.phar selfupdate right now. Two newly disclosed command i…
Rockstar Refused to Pay — So ShinyHunters Just Leaked 78 Million Records
Rockstar Games refused to blink — and now millions of records from its online gaming platforms are sitting on the dark web. The ShinyHunters threat g…
Apache Tomcat's Security Fix Opened the Door to Unauthenticated RCE
Sometimes the cure is worse than the disease. That is precisely what happened when Apache's developers patched a cryptographic weakness in Tomcat…
Kraken Refuses to Pay Criminal Extortionists After Two Insider Breaches Exposed 2,000 Client Accounts
Crypto exchange Kraken is standing firm against an active extortion campaign after criminals — armed with recorded videos of internal support systems…
Critical Axios Flaw Enables Full Cloud Takeover
Axios, the JavaScript HTTP client powering over 100 million npm downloads every week, is under fire again — this time from a quietly lurking code-lev…