Expert analysis on threats, compliance, and the evolving security landscape.
2026-03-25 · 11 min read
LiteLLM versions 1.82.7 and 1.82.8 on PyPI were compromised by the TeamPCP threat actor group. The malicious packages stole credentials, deployed persistence via systemd, and performed lateral movement in Kubernetes clusters. The attack propagated from the earlier Trivy supply chain compromise through LiteLLM’s own CI/CD pipeline.
By Mohit Kumar
2026-03-20 · 9 min read
CVE-2026-28353 is a CVSS 10.0 supply chain compromise of the Trivy VS Code Extension on OpenVSX. A stolen GitHub PAT, extracted through a misconfigured pull_request_target workflow, was used to publish tampered extension versions that weaponized local AI coding agents for credential theft and data exfiltration via prompt injection.
By Yash Kumar
2026-03-14 · 12 min read
From malicious IDE extensions to AI hallucination attacks and self-replicating supply chain worms — the modern development toolchain is under sustained attack. This blog examines the four major vectors and what organisations should do about them.
By Hazza Shaikh
2026-03-14 · 9 min read
Shadow AI is spreading faster than shadow IT ever did. Employees are granting AI tools full machine access, pushing sensitive data into models, and nobody is tracking which tools are in use. Here is why AI-BOM and AI asset registers are becoming essential governance infrastructure.
By Yash Kumar
2026-03-14 · 9 min read
How JavaScript and Mobile Crypto Creates a False Sense of Security — and Quietly Defeats Your WAF
By Yash Kumar
2026-03-14 · 5 min read
Why vulnerability management alone isn't cutting it anymore and how CTEM gives security leaders a framework to continuously discover, prioritise, and remediate real exposure across sprawling attack surfaces, not just chase CVE counts.
By Yash Kumar
2026-03-14 · 8 min read
Moving from Fragmentation to a Single Source of Truth. See every API. Control every API.
By Sunil Yadav
2026-01-29 · 5 min read
A practical guide for Indian enterprises navigating CERT-In, SEBI CSCRF, and the reality of managing third-party software risk
By Sunil Yadav
Page 3 of 3
