Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

7 Core Principles of an Effective Application Security Program

If you’re building software, chances are your environment looks nothing like it did a few years ago. Monolithic applications have given way to microservices. On-prem systems have migrated to multi-cloud. Waterfall has become agile, and developers are pushing code daily (sometimes hourly). Security, meanwhile, is still catching up.

Threat Context monthly, April 2025: EncryptHub & Media Land leak

Welcome to the Threat Context Monthly blog series where we provide a comprehensive roundup of the most relevant cybersecurity news and threat information from KrakenLabs, Outpost24’s cyber threat intelligence team. Here’s what you need to know from April about EncryptHub, EncryptRAT, and the Media Land leak.

And The Cloud Goes Wild: Looking at Vulnerabilities in Cloud Assets

We admit it – we’ve had our heads in the clouds recently. Since we started working with Wiz as one of their integration partners, we’ve been spending even more time thinking about cloud assets. And these assets are everywhere! Gartner predicts double digit growth across all cloud segments in 2025.

Raising the Security Bar: Essential Measures to Combat Emerging Cyber Threats

Cyber threats are evolving all the time, and the pace of advancement is increasing. From malware and ransomware attacks to increasingly sophisticated phishing techniques and zero-day exploits, threat actors are constantly working to find new ways to breach our defenses, so we need to take proactive steps to raise security standards and keep our organizations on the front foot in the fight against cybercrime. In this piece, we'll discuss some essential measures you can take to do this, highlighting best practices and security technologies that can enable you to build a more threat-resilient organization.

OWASP Announces BLADE Business Logic Attack Framework to Give Enterprises Better Tools to Fight Sophisticated Bots

Update to attack framework announced to coincide with recognition as an industry standard The Open Worldwide Application Security Project (OWASP) announced today that the Business Logic Attack Definition Framework (BLADE Framework) has become The OWASP BLADE Framework Project. The name change reflects the acceptance of the attack framework as an OWASP project and recognition of the framework as an industry standard.

Emerging Threat: SAP NetWeaver Visual Composer CVE-2025-31324

On April 24th, 2025, SAP disclosed CVE-2025-31324, a critical missing authorization check vulnerability (CVSS 10.0) affecting the Metadata Uploader component of SAP NetWeaver Visual Composer. This vulnerability fails to restrict file upload content, allowing unauthenticated remote attackers to achieve full remote code execution (RCE) on affected servers.

Security Bulletin: CVE Program Funding Concerns and Emerging Alternatives

On April 16, 2025, a critical moment unfolded in the cybersecurity world when the U.S. Department of Homeland Security’s funding for the Common Vulnerabilities and Exposures (CVE) Program, operated by MITRE, was set to expire. The CVE system is a globally relied-upon database for cataloging known cyber vulnerabilities and has been a cornerstone of vulnerability management for over 25 years since its public launch in 1999.

Zero-Day Readiness: How ASPM Can Help CISOs Respond Faster

Zero-day vulnerabilities are the new normal in cybersecurity. In 2023 alone, more than 100 high-profile zero-day incidents were reported. Despite the early warning signs, major corporations and government agencies, from giants like Google and Cisco to the U.S. Government, continue to be blindsided by zero-day threats into 2025. In December 2024, for example, the U.S.

Can This AI Save My Job? (Google Gemini 2.5 Pro)

In this video, I’ll be putting Google’s Gemini 2.5 AI to the test — challenging it to generate 100% secure and safe code for a note taking application. The catch? My job is on the line... and the code has to pass all security checks to avoid critical vulnerabilities. I’ll be diving into how Gemini 2.5 performs under pressure and examining whether AI can truly be trusted with secure coding. Resources.