AI & ML

Dependency Confusion Attacks — How They Work and How to Protect Your Pipeline

dependency confusion attack helped security researcher Alex Birsan earn $130,000 in bug bounties after demonstrating that build systems at Apple, Mi…

Dependency Pinning vs Floating Versions — What Security Teams Need to Know

A dependency version can decide whether your production build installs the same safe code every time or silently pulls a different release. lodash@4…

Free vs Paid SCA Tools — When Does Paying for Vulnerability Monitoring Make Sense?

There are excellent free Software Composition Analysis tools. Many teams can start with GitHub Dependabot, OWASP Dependency-Check, npm audit , pip-a…

LiteLLM CVE-2026-42271 Exploited in the Wild — AI Gateway Flaw Chains to Unauthenticated RCE

AI infrastructure is becoming a serious attack surface. The latest example is LiteLLM CVE-2026-42271 , a command injection vulnerability in BerriAI…