Welcome to our blog.
Surviving cybersecurity until the end of 2026
After Binance, LiteLLM, PHP2Shell and eMudhra, here are six practices and a checklist to limit what the next compromise can reach before 2027.
Critical Linux kernel TCP vulnerability can allow remote code execution (CVE-2026-98432)
Under specific conditions, a remote attacker with no credentials can run code on an unpatched Linux server, and a proof of concept has been reported for servers with a multipath TCP listener. See who is affected, how to patch, and what to do if your vendor has no fix yet.
2026 State of AI in Pentesting
Our latest report captures the perspectives of 400 CISOs, CTOs, and senior engineering leaders across Europe and the US. It explores how AI is changing penetration testing, why traditional approaches are struggling to keep pace with modern software delivery, and what security leaders want from the next generation of penetration testing.
Aikido and Deel: set up once, secure every hire
Code, cloud, and devices, covered automatically once someone's hired through Deel.
Novel supplychain.local Go worm appears
"supplychain.local": malicious code found in MemTensor's npm plugin (0.1.21, 0.1.23) and PyPI's MemoryOS (2.0.34).
Send GitLab an email, push to main
GitLab gives you a private email address to create issues. If leaked, anyone who has it can push code, execute CI/CD jobs, and bypass IP restrictions across all of your public and private projects.
Cyber Resilience Act is here! Myth busting and first impressions
The Cyber Resilience Act's first deadline just came up on September 11, 2026. What the new Single Reporting Platform looks like, and four common CRA myths debunked.
Graphalgo campaign spreads to Terraform providers and Go Modules
Graphalgo malware has now spread to Go, showing up in two Terraform providers and two Go modules.
Jason Haddix: Stop fearing AI pentesting
Jason Haddix on why manual pentesting can't keep up, what disappears first, and why human methodology is what makes AI pentesting work
Compromised Flutter package on pub.dev contains XCSSET malware
We detected XCSSET malware inside a compromised Flutter package on pub.dev. Here is a full breakdown of the infection chain, propagation modules, and stealer logic we found inside.
Stop breaking SLAs: how to patch vulnerabilities before the fix even ships
Learn how to meet security SLAs for dependency vulnerabilities with Aikido Libraries by using delivering secure, backported patches.
MECCHA CHAMELEON can't hide from the RCE
We found a second delayed RCE in MECCHA CHAMELEON: a malicious custom map could write files anywhere on your system and run code after a restart. Now patched in 4.0.0.
The dark figure of supply chain detection
String-based rules only catch malware that's already been seen. Behavioral detection is how you find the supply chain attacks.
Aikido launches Noon: workforce security for every employee
Aikido launches Noon, a workforce security business. AI governance, device and email protection, and training against AI-powered phishing and deepfakes.
wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories
A wave of compromised accounts are pushing a CI secret stealer. See if you’re affected, what it steals, and what to rotate.
Top 10 Software Composition Analysis (SCA) tools in 2026
SCA tools are our best line of defense for open-source security, this article explores the top 10 open-source dependency scanners for 2026
AI Pentesting Buyer's Guide: How to evaluate AI pentesting vendors
Learn how to evaluate AI pentesting vendors with practical buying criteria, research from 1,000+ AI pentests, and a downloadable evaluation checklist.
A practical CTO security checklist to be Mythos-ready
A practical checklist for SaaS CTOs navigating a world with Mythos and agentic AI threats. Built around the defender's advantage: you have context attackers have to work to get. Covers the controls, practices, and operational habits that determine whether your team finds and fixes issues before someone else does.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system.
Connect a repo to discover what the reasoning agents find in your codebase.
