2026
- April 28 - The Ghost in the Shopping Cart: Exploring Logic Flaws in a Retail Giant
- May 14 - Prompt In, Shell Out: Exploiting GitHub AI Toolchains
- May 21 - What 100+ BOLA Reports Taught Us About Where Object-Level Authorization Actually Fails
- June 1 - Beyond the $175K Bankrbot Hack: Encoding Attacks Across Layers of the Agentic AI Stack
- June 25 - All That Glitters Isn't Prompt Injection: Rethinking The Meta Instagram Takeover
- July 14 - The Proxy Problem: Applying Goodhart's Law to AI-Generated Vulnerability Reports
- July 28 - The Seven Wonders of OAuth Exploitation
- August 5 - Mass Assignment: The Silent Killer of Application Security
- August 20 - Catfishing the Allowlist: Introducing MCP Security's Argument Injection Blind Spot
- September 1 - Trust Me, Bro: Forging Security Labels in Microsoft's FIDES Middleware
- September 8 - Observable ≠ Exploitable: The Problem With OAuth Security Measurements
- September 15 - Hijacking Google ADK Using Malicious A2A Peers
- September 23 - ZOOMSDAY: What Happens When Exploits Outrun Patches?
- September 25 - It's not a vulnerability until the money moves
- October 2 - What Does Your MCP Attack Surface Look Like From the Outside?
- October 13 - CVE-2026-108953: OS Command Injection by Whitelist Bypass in mac-shell-mcp
- October 15 - Enterprises are pausing development to fix vulnerabilities. A comparison of the approaches on the table.
- October 21 - Light It Up: Agentic Guardrail Bypass to Code Execution in FastLED's MCP Server (CVE-2026-78812)