17 articles
A GitHub Actions policy change puts privileged pull request workflows under scrutiny. Here is what maintainers can do before enforcement.
José Palanco · 
Separate PHP runtime exposure from application findings, verify worker replacement and keep remediation evidence reviewable with Plexicus.
José Palanco · 
EMBRACE is a useful reminder that an embedded browser does not automatically keep the security boundaries of a standalone browser.
José Palanco · 
Cloudflare’s open-source coding-agent skill uses coverage-led hunting, independent validation, and structured evidence. Here is what the workflow can—and cannot—establish.
José Palanco · 
AI can help analysts navigate compiled software, but a decompiler output is not a vulnerability report. See how REA changes analysis, why reverse- engineering agents need protection, and how teams can validate findings.
José Palanco · 
Three systems asserted a condition and none of them checked whether it still held. A registry reported a package was attested. An evaluation harness reported a model was offline. An assistant reported a package would work.
José Palanco · 
An editorial guide to security MCP integrations for AI-assisted development: repository findings, scanning, web testing, supply chain analysis, and cloud security.
José Palanco · 
How specialized attack agents share context, challenge hypotheses, and independently verify attack paths inside the Plexicus Proof-Driven AppSec workflow.
José Palanco · 
A complete guide to application security in 2026, from secure design and software supply chains to testing, exploit validation, remediation, and Proof-Driven AppSec.
José Palanco · 
A fruit-fly connectome offers a vivid test of a security principle: a demo is not proof until controls show what the advertised system contributes.
José Palanco · 
DevDay 2026 connected persistent agents, cloud coding, plugins, events, and shared work. Here is what shipped, what is still coming, and where AppSec boundaries lie.
José Palanco · 
Opus 5.5 motion-graphics demos reveal an agentic loop: plan, write code, run it, inspect, revise. Claude cybersecurity now depends on verification keeping pace.
José Palanco · 
MAESTRO is the Cloud Security Alliance's 7-layer framework for agentic AI threat modeling, applied by the OWASP GenAI Security Project. This guide turns each layer into a pentest checklist.
José Palanco · 
AI can remove repetitive AppSec work without removing accountability. Learn how to decide what to automate, what to augment, and when a security decision should be escalated to a person.
José Palanco · 
SAST false positives bury real bugs, and an LLM wrapper does not fix that. Deep Code Analysis uses reachability analysis to prove which findings are real, reachable, and worth fixing.
Josuanstya Lovdianchel · 
今日、ソフトウェアを構築または運用している場合、おそらくマイクロサービス、サーバーレス関数、コンテナ、サードパーティパッケージ、およびコンプライアンスチェックボックスの雪崩を処理していることでしょう。それぞれの動く部分が独自の発見、ダッシュボード、そして赤い警告を生み出します。やがて、リスクの可視性は午前2時のサンフランシスコの霧の中を運転するような感覚になります。危険がそこにあることはわかっているが、はっきりとは見えないのです。
José Palanco · 
PlexicusとCéfirosの新たな協力により、ラテンアメリカとイベリアの19か国でアプリケーションセキュリティが強化される予定です。このサイバーセキュリティの協力は、サイバー脅威に対抗するために積極的に防御を求める組織に、先進的なアプリケーションセキュリティポスチャーマネジメント（ASPM）ソリューションを提供します。
José Palanco · Plexicus is Proof-Driven AppSec: validated findings, contextual understanding, and reviewed remediation — anchored in evidence, scoped with you.
