Malware in the software supply chain is surging. More than 90% of all malware advisories for open source software ever filed landed in 2025 alone. The threat is evolving fast. Organizational defenses ...

Teams in regulated industries can run Endor Labs AI SAST on their own LLM provider account to meet strict governance and data handling requirements. Today, we're introducing bring your own key (BYOK) ...

Endor Labs discovered a critical vulnerability in n8n (CVE-2026-25049) that allows unauthenticated users to achieve remote code execution (RCE) via sandbox escape. We discovered a critical ...

Fable 5 has just been released as Anthropic's generally available, safeguarded Mythos-class model, with high expectations following the strong results Anthropic reported across software engineering, ...

As of mid-August 2026, the number of Cyber Resilience Act harmonized standards published in the Official Journal is zero. Not "a handful" — zero. The Article 27 presumption of conformity is therefore ...

Your developers asked an AI assistant for code this morning, and it shipped by lunch. AI security is the practice of protecting AI systems, using AI to defend other systems, and securing the code AI ...

Partnership Brings Together Reachability-Backed Static Analysis and Runtime Exploit Validation to prioritize and fix ...

Most security teams have a process for securing open source dependencies. Packages get pinned, scanned in CI, and checked against policy before they ship. VS Code extensions skip all of that. A ...

SAST (Static Application Security Testing) is a white-box method that analyzes an application's source code, bytecode, or binaries for security flaws without running it. It reads code the way a ...

An AI agent just opened a pull request to patch a vulnerable library. Should you merge it? DevSecOps is the practice of building software that puts automated security checks into every stage of ...

So, what is code security? Code security is the practice of finding, fixing, and preventing security weaknesses in software before it reaches production. It covers your own code, open-source ...