Postman is sharing the evolution of their Security Review Process (SRP). What didn't work, what they changed, and how they built SRP v2, a risk-based, automation-first security model embedded directly into their SDLC.

How Block built benchmrk, a harness for measuring SAST scanner efficacy against ground truth you control.

NVD's April 2026 scope reduction (enriching only KEVs and critical federal software) collides with AI-accelerated vulnerability discovery (e.g., Claude Mythos), creating a dangerous gap in OSS CVE coverage.

A supply chain attack ("Mini Shai Hulud") trojanized SAP npm packages with malicious "preinstall" scripts that download a credential-stealing payload, harvesting GitHub, cloud, and CI/CD secrets, exfiltrating via attacker-controlled GitHub repos.

A report which identifies 14 BigQuery threat vectors (covering data confidentiality, integrity, and availability) including IAM privilege escalation, data exfiltration via unrestricted egress, schema tampering, cost-based DoS, insider misuse, and service account spoofing.

Wiz Research discovered CVE-2026-3854 (CVSS 8.7): an unsanitized semicolon injection in GitHub's X-Stat internal header allows any authenticated user to override security fields via git push -o, achieving RCE on GitHub.com and full GHES server compromise.

The same 732-byte Python script roots every Linux distribution shipped since 2017.

A lone port 22, wide open, accepting every password. 269,000 connections, 7,556 unique IPs, and a few visitors who thought they'd hit the jackpot.

A swiss-knife MCP server for analysing PCAP files.

TUI to explore Terraform providers.

AI coding assistant skill that turns any folder of code, docs, papers, images, or videos into a queryable knowledge graph.

OpenShell is the safe, private runtime for autonomous AI agents.

May 21, 2026 | Minneapolis, United States

May 21-22, 2026 | Minneapolis, United States