ReversingLabs

It started with a phone call from a friend. He’d tried to log into his university’s Student Association website — a site he used constantly and trusted — and hit a strange CAPTCHA screen. Something felt off. He asked me to take a look.I did. Working with RL’s Spectra Analyze, I ran interactive dynamic analysis. What I found was a textbook ClickFix attack. The student site was compromised and used as a “watering hole” to draw in potential victims. Key to the attack was a pixel-perfect fake Google

Key takeawaysClaude Code Security uses AI reasoning to find logic-level flaws that rules-based SAST misses. Anthropic says it found 500+ overlooked vulnerabilities.It could sharply cut SAST false positives, which run from 68% to 91%.It only sees source code, so it misses deployed artifacts and supply chain attacks like SolarWinds and Log4Shell.It adds to a full AppSec program; it doesn’t replace one.Claude Code Security has attracted considerable attention because it brings AI reasoning directly

Key takeawaysTop mathematicians are moving into AI safety.Fields Medalist Jacob Tsimerman launched MAISI, and Turing winner Shafi Goldwasser co-founded RESI.Proofs can verify what AI does.Zero-knowledge proofs could confirm an agent’s actions and claims without exposing its model or data.Guarantees are only as good as their assumptions.The Hugging Face sandbox escape shows how easily reality can diverge from what a proof assumed.Hard limits beat universal proofs for now.Rules enforced outside th

For years, software supply chain security (SSCS) lived like a teenager in the basement of a bigger house. It was a line item inside the sprawling application security testing (AST) world — important, occasionally praised at dinner, but never quite trusted with its own keys. Everybody nodded along about software bills of material (SBOMs) and provenance the way you nod along about flossing.On June 17, the basement kid got the keys. Gartner published its very firstMagic Quadrant™ for Software Suppl

The rapid adoption of AI coding agents is outpacing the security controls organizations have put in place to govern them.According to JetBrains’ 2025 Developer Survey,85% of developersnow regularly use AI tools for coding and development, and 62% use at least one AI coding assistant.Gartnerprojects that figure will reach 90% of enterprise software engineers by 2028.The security implications are significant. Coding agents have broad access to source code, repositories, credentials, and CI/CD pipe

The inaugural Gartner Magic Quadrant™ for Software Supply Chain Security evaluates 18 vendors across more than 37  pages of research. Most security teams will read the executive summary, look at the graphic, and move on.That’s a miss because the evaluation criteria, the Mandatory Features list, Gartner identified across the field give AppSec leaders exactly the framework they need to run a sharper, faster vendor evaluation.In our experience, here are the five things that matter most.[ Learn howR

Somewhere between a fake CAPTCHA page and an open Run dialog, the security model at most organizations breaks down. That is the uncomfortable conclusion of ReversingLabs’ new threat research report,”Copy, Paste, Compromise: The Tale of ClickFix,”by RL researcher Toni Dujmović and the RL Threat Intelligence Research team.ClickFix, a social engineering technique first identified in 2023, is one of the most widely deployed attack methodologies in the current threat landscape — precisely because to

We believe the release of a new Gartner Magic Quadrant is always a watershed moment for the technology sector. In our opinion,  it signals that a specific category of software has matured from a niche collection of tools into a vital, formalized market. For software engineering and security testing teams, the latest report covering software supply chain security represents a massive shift in how organizations protect their code, their infrastructure, and their customers.Before this formal recogn