A Tale of Two SOCs: CISA's AA26-237A and the Control Your Audit Cannot Test
CISA's red team ran two simultaneous assessments against US critical infrastructure with similar tradecraft. Both organizations were fully compromised...
SOC 2
7 articles on SOC 2 — privacy laws, security frameworks, and regulatory compliance.
A CVSS 10.0 You Cannot Patch: Entra ID CVE-2026-69836 and the Governance Gap in Provider-Remediated Vulnerabilities
Microsoft disclosed a maximum-severity remote code execution flaw in Entra ID, the authentication control plane underneath every access control most e...
One HTTP Request, Zero Credentials: GitLab CVE-2026-19478 and the Source Code Integrity Control Nobody Scoped
GitLab shipped an out-of-band emergency patch on August 17, 2026 for CVE-2026-19478, a CVSS 9.4 unauthenticated code injection in the GraphQL @gl_intr...
The OAuth Governance Gap: What the Vercel and Lovable Incidents Mean for Your Compliance Program
Two high-profile security incidents broke within hours of each other on April 19–20, 2026. Both involved AI platforms. Both exposed real customer data...
Five Lawsuits and Counting: A Compliance Breakdown of the Mercor Data Breach Litigation
In the span of a single week, five separate class action lawsuits landed in federal courts against Mercor.io Corporation. The complaints vary in scope...
Fake Compliance, Stolen Credentials, and 4 Terabytes of AI Secrets: Inside the Class Action That Connects Mercor, LiteLLM, and Delve
A supply chain attack, a compliance fraud scandal, and invasive contractor surveillance converge in a single federal lawsuit — exposing the fragile tr...
The Delve Scandal: When Your SOC 2 Report Is Just a Template
A YC-backed compliance startup is accused of mass-producing fraudulent SOC 2, ISO 27001, HIPAA, and GDPR reports for hundreds of clients — and has now...