.svg){kind=small}
Inside the Marketing Script That Served Malware to 100,000 Sites
A hardcoded API key turned Brevo's scripts into a malware channel for 100,000+ sites. Three September attacks that came through tools companies had already approved. What it means for your test scope.
Read Now
Inside the Breach OpenAI Caused Itself
OpenAI's own test agents escaped their sandbox and breached Hugging Face's servers, even after the hole was rebuilt. Three August incidents where the fix existed and nobody closed it. What it means for how you measure closure.
Read Now
Inside the First AI-Run Ransomware Attack
An AI agent ran the JADEPUFFER ransomware attack end to end. The way in was a Langflow flaw public for over a year. What it means for your attack surface.
Read Now
The API that forgot to ask "who are you?"
One flag set to false. No credentials needed. ServiceNow's breach shows why SaaS authentication is now your problem to verify.
Read Now
Vibe Coding Broke Your AppSec Pipeline
Three real incidents from early 2026, the data behind why 45% of AI-generated code fails basic security checks, and why your AppSec pipeline wasn't built for dev speed.
Read Now
Why AI Agents Are Failing Security Tests in 2026
The state of AI app security in 2026, what's being exploited, what Q1 taught us, and practical steps before your next release.
Read Now
The Agentic Blast Radius
Why your agent frameworks might be the biggest insider threat you haven't audited yet. Let's go.
Read Now
Start 2026 Strong: Yearly Security Assessment (Templates & Checklists Inside!)
What happens after the scan, how can security teams build a clear plan from assessment data? From knowing what you own and what to test, to prioritizing risk and, how to prioritize risks.
Read Now
Critical Takeaways from 2025 to Preemptive Security in 2026
A year-end edition of ROAR breaking down the most important security shifts of 2025 from major breaches, forced outages, and the rise of AI-driven attacks.
Read Now