Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

If your organization stores, processes, or transmits cardholder data, then application security for the Payment Card Industry Data Security Standard (PCI DSS) is a discipline you sustain. And with PCI DSS v4.0.1 now in effect, the standard has stopped accepting passive, point-in-time testing as evidence of a mature security posture. It wants continuous proof.

This briefing covers two distinct horizons. The past week (23–30 September 2026) is a cluster of material, actively exploited edge and enterprise-application flaws, plus confirmed identity and third-party incidents. The past month (31 August–30 September 2026) shows those events as part of a faster pattern: perimeter appliances as the preferred initial-access class, build systems as ransomware feedstock, non-human identity as a wipe and extortion primitive, and overlapping EU and U.S.

Application security testing (AST) is the practice of scanning software for vulnerabilities using static, dynamic, and component-level analysis – then managing those flaws through remediation, validation, and certification. A new independent report from FOURCASTERS and Lionfish Tech Advisors confirms that AST is not becoming obsolete. AI and cloud platforms are changing how testing gets delivered, but the need for independent testing, flaw lifecycle management, and validation has only grown.

Third-party code now accounts for 66% of the most dangerous, long-lived vulnerabilities across application portfolios, according to Veracode’s 2026 State of Software Security Report. For AppSec and engineering leaders, that stat tells a familiar story: shrinking release cycles, expanding open-source dependency footprints, and mounting regulatory pressure.

The week’s material risk is not a single CVE. It is the identity and policy control plane. In seven days, CISA confirmed active exploitation against Cisco Identity Services Engine, Check Point VPN and management servers, F5 BIG-IP Access Policy Manager when used as an OAuth authorization server, and Arista’s on-prem VeloCloud Orchestrator. These products issue tokens, enforce network policy, or orchestrate SD-WAN.

AppSec teams know application risk is growing, but budget conversations are often won and lost outside the security team, in rooms full of executives who speak the language of revenue and delivery velocity, not CVSS scores. The core argument: application security software is easier to fund when it is tied to growth, resilience, compliance, and delivery outcomes… not just technical findings.

There are lots of terms used to generalize what a mature application security program looks like. Find & Fix. Continuous Remediation. Code to Cloud, Unified Risk. The underlying message in these buzzwords is the same: security needs to be systemic. Defense in Depth is preached as a security best practice by leading cybersecurity agencies like NIST and CISA, and these principles are especially relevant to the metastasizing software supply chain risk seen across enterprises.

The European Union has made great strides to enhance cybersecurity over the past few years, with a comprehensive framework of core legislative acts designed to protect critical infrastructure. The EU Cyber Resilience Act, originally published as Regulation (EU) 2024/2847 on 20 November 2024, and entered into force on 10 December 2024, shifts the burden of proof so that manufacturers must now show their software is secure, not just claim it.

Exploitation of software vulnerabilities is now the number one cause of breaches, according to the 2026 Verizon DBIR Report. At the same time, release velocity keeps climbing and AI coding tools are now authoring roughly half of all committed code in organizations that use them. For application security and engineering teams, the math is unforgiving: more code, faster delivery, and a growing attack surface.

This executive intelligence briefing covers from the past week (2–9 September 2026) and the past month (approximately 10 August – 9 September 2026). CISOs, start here: do not open a 974-row spreadsheet. That queue is the failure mode. This week’s material risk sits in four places you can name before noon.