17 articles
A GitHub Actions policy change puts privileged pull request workflows under scrutiny. Here is what maintainers can do before enforcement.
José Palanco · 
Separate PHP runtime exposure from application findings, verify worker replacement and keep remediation evidence reviewable with Plexicus.
José Palanco · 
EMBRACE is a useful reminder that an embedded browser does not automatically keep the security boundaries of a standalone browser.
José Palanco · 
Cloudflare’s open-source coding-agent skill uses coverage-led hunting, independent validation, and structured evidence. Here is what the workflow can—and cannot—establish.
José Palanco · 
AI can help analysts navigate compiled software, but a decompiler output is not a vulnerability report. See how REA changes analysis, why reverse- engineering agents need protection, and how teams can validate findings.
José Palanco · 
Three systems asserted a condition and none of them checked whether it still held. A registry reported a package was attested. An evaluation harness reported a model was offline. An assistant reported a package would work.
José Palanco · 
An editorial guide to security MCP integrations for AI-assisted development: repository findings, scanning, web testing, supply chain analysis, and cloud security.
José Palanco · 
How specialized attack agents share context, challenge hypotheses, and independently verify attack paths inside the Plexicus Proof-Driven AppSec workflow.
José Palanco · 
A complete guide to application security in 2026, from secure design and software supply chains to testing, exploit validation, remediation, and Proof-Driven AppSec.
José Palanco · 
A fruit-fly connectome offers a vivid test of a security principle: a demo is not proof until controls show what the advertised system contributes.
José Palanco · 
DevDay 2026 connected persistent agents, cloud coding, plugins, events, and shared work. Here is what shipped, what is still coming, and where AppSec boundaries lie.
José Palanco · 
Opus 5.5 motion-graphics demos reveal an agentic loop: plan, write code, run it, inspect, revise. Claude cybersecurity now depends on verification keeping pace.
José Palanco · 
MAESTRO is the Cloud Security Alliance's 7-layer framework for agentic AI threat modeling, applied by the OWASP GenAI Security Project. This guide turns each layer into a pentest checklist.
José Palanco · 
AI can remove repetitive AppSec work without removing accountability. Learn how to decide what to automate, what to augment, and when a security decision should be escalated to a person.
José Palanco · 
SAST false positives bury real bugs, and an LLM wrapper does not fix that. Deep Code Analysis uses reachability analysis to prove which findings are real, reachable, and worth fixing.
Josuanstya Lovdianchel · 
Om du bygger eller driver mjukvara idag jonglerar du förmodligen med mikrotjänster, serverlösa funktioner, containrar, tredjepartspaket och en lavin av efterlevnadskontroller. Varje rörlig del genererar sina egna fynd, instrumentpaneler och ilskna röda varningar. Inom kort känns riskinsyn som att köra i San Franciscos dimma klockan 2 på morgonen - du vet att det finns faror där ute, men du kan inte riktigt se dem.
José Palanco · 
Ett nytt samarbete mellan Plexicus och Céfiros kommer att förbättra applikationssäkerheten i 19 länder i Latam och Iberia. Detta cybersäkerhetssamarbete erbjuder avancerade lösningar för hantering av applikationssäkerhetsställning (ASPM) till organisationer som vill försvara sig proaktivt mot cyberhot.
José Palanco · Plexicus is Proof-Driven AppSec: validated findings, contextual understanding, and reviewed remediation — anchored in evidence, scoped with you.
