A known PeopleSoft flaw, Java deserialization, and an unpatched system were enough to expose sensitive FBI data. The bigger lesson is not just “patch faster.” It is that once malicious code reaches the application runtime, security teams need visibility into what actually executed and the ability to stop it there. Read the breakdown: na2.hubs.ly/H08zY_C0

Node2Shell is here. Right after PHP2Shell, we now have a high-severity RCE in http://Node.js itself: CVE-2026-111497. A crafted Brotli stream can trigger an out-of-bounds write in the decoder that ships with http://Node.js. It is reached automatically — through Express/body-parser on incoming Content-Encoding: br requests, or through the built-in fetch() on responses. No application bug required. The runtime is the attack surface. This is exactly the kind of capability Raven mapped in The 14 Most Powerful Families in Software. The Brotli decoder sits at the intersection of the Customs Officer (parsing untrusted input) and the Smuggler (native code), fed by the Doorman (Express). These libraries disappear at runtime. Attackers already know the path. Patch to 22.23.4 / 24.22.1 / 26.12.1. Then ask the harder question: what else is executing that you cannot see? Read the technical analysis: na2.hubs.ly/H08zYS60 Download the Raven research: na2.hubs.ly/H08zYS70 #NodeJS #ApplicationSecurity #RuntimeSecurity #OpenSourceSecurity

Not every critical vulnerability is equally critical in your environment. Runtime evidence shows which libraries are actually loaded, which execute, and whether the vulnerable function itself ran. That gives AppSec teams a much clearer way to decide what deserves attention first. See how runtime context can sharpen vulnerability prioritization: na2.hubs.ly/H08xhqX0 #ApplicationSecurity #RuntimeSecurity #VulnerabilityManagement #AppSec

SOC teams need application level context.  Watch as Omer explains how runtime application context connects suspicious behavior back to the code itself, including the library, function, and execution path responsible. That context can help SOC teams investigate faster, reduce guesswork, and understand whether an event represents real application risk. Watch the full webinar on demand: na2.hubs.ly/H08xh730 #RuntimeSecurity #SOC #ApplicationSecurity #ADR

The runtime is part of your attack surface. PHP2Shell just proved it. Two new PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) can allow unauthenticated remote code execution. On Apache mod_php, exploitation can start before your application code gets control. No unsafe upload handler required. No session_start() required. Just PHP parsing a crafted request and mishandling an out-of-memory failure. With PHP behind roughly 70% of sites with a known server-side language, this one is worth your attention today. ✅ Update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 ✅ Inventory the runtime and its config, not just your packages ✅ Look for execution evidence, not just request logs Full breakdown from our team: na2.hubs.ly/H08xRDV0 #PHP #AppSec #RuntimeSecurity #CyberSecurity

Open-source attacks move faster than most AppSec programs can respond. When a vulnerable or malicious package reaches production, the question becomes whether your team can see what is actually running, understand the real exposure, and respond before it turns into an incident. The ADR Readiness Assessment helps benchmark how prepared your security program is for that reality. 11 questions. About 3 minutes. Take the assessment: na2.hubs.ly/H08lK170

AI is killing SCA and ASPM as we know them. AI-generated code is creating security risks that may never get a CVE. No advisory. No severity score. No finding to prioritize. For CISOs, that raises a question: What does your security strategy look like when there’s no CVE to act on? SCA and ASPM help us manage known vulnerabilities. But prioritization can’t protect us from risks that never enter the queue. We need to ask more than “What do we need to patch?” What should the code running in our applications be allowed to do? Should a third-party library be able to launch a shell? Read sensitive files? Make an unexpected outbound connection? We can set and enforce those boundaries before a CVE exists. Patching and prioritization remain essential. But protection cannot wait for disclosure. In my latest blog, “AI Is Killing SCA and ASPM as We Know Them,” I explore what comes next for third-party code security. na2.hubs.ly/H08kMS_0

The vulnerability apocalypse is coming. Anthropic just announced free AI-powered vulnerability scanning for open-source maintainers. Now imagine thousands of projects opting in. An explosion of vulnerabilities. Overwhelmed maintainers. Security teams drowning in CVEs. Enterprises unable to patch fast enough. AI is accelerating vulnerability discovery faster than organizations can remediate. And attackers don't need to wait for a CVE anymore. Why should your security strategy depend on one? Raven’s latest perspective on the future of application security. Read the full blog: na2.hubs.ly/H08kC3P0

🚨 Last chance to register. We’re live tomorrow. Join Raven and James Berthoty of Latio for Before the CVE: The 14 Software Families AI Will Target First. We’ll reveal original research, explore how AI is accelerating pre-CVE attacks, and demonstrate live exploits traced to the exact open-source library, function, input, and runtime call chain responsible. 📅 Tomorrow, October 8 ⏰ 12 PM ET / 9 AM PT 🔗 na2.hubs.ly/H08fd710 Can’t attend live? Register anyway and we’ll send you the recording.

AppSec teams need more than infrastructure-level visibility. EDR is still an important part of the security stack. It helps teams monitor processes, files, network activity, system calls, and suspicious behavior across endpoints and workloads. But when the issue is inside a production application, AppSec needs deeper context to understand which library, function, request, and execution path caused the behavior. That is where ADR fits. EDR shows what happened on the workload. ADR adds the application context needed to understand why it happened and what developers should fix. See how ADR and EDR work together: na2.hubs.ly/H088x-Q0 #ADR #EDR #ApplicationSecurity #RuntimeSecurity

Is it possible to PREVENT the exploit without knowing the vulnerability? Yes, if you can see and control what code is doing at runtime. Unknown exploits may not have a CVE, signature, or rule yet, but they still have to execute. Runtime security focuses on that behavior, helping teams stop dangerous actions before they become a successful attack. More on preventing unknown exploits: na2.hubs.ly/H083q7k0 #RuntimeSecurity #ApplicationSecurity #ZeroDay #Cybersecurity

Compliance frameworks increasingly expect organizations to prove how production applications are protected. DORA. PCI DSS. SOC 2. ISO 27001. NIST. FedRAMP. The challenge is turning runtime security into evidence auditors and security teams can actually use. Cleared for Runtime looks at how production visibility, prevention, and runtime evidence can support those requirements. na2.hubs.ly/H083pQN0 #Compliance #RuntimeSecurity #ApplicationSecurity

AI is changing more than how software gets built. It is changing how quickly attackers can study public code, identify weaknesses, develop exploit paths, and move from discovery to execution. Security models built around known vulnerabilities and completed patches were not designed for that speed. The next generation of application security needs to understand what code is actually doing in production and prevent dangerous behavior at the moment of execution, whether a CVE exists or not. Join Raven on October 8 for Before the CVE, where we will break down the 14 software families we believe deserve the closest attention in the AI era. Save your seat: na2.hubs.ly/H0825Wj0 #AIsecurity #RuntimeSecurity #AppSec #Cybersecurity

Family 14 of the Raven Power List: Identity-String Normalization Primitives — "The Double." Two names, one face. Normalization and encoding primitives decide when two different strings count as "the same." Get it wrong and you get spoofing, filter bypass and account confusion — one identity wearing another's face. The Double's risk hides in the gap between what a filter checked and what the system finally used. That gap only appears at runtime. The 14th and final family in our new research. Download the research: na2.hubs.ly/H07-3Dd0 #AppSec #ApplicationSecurity #Cybersecurity #OpenSourceSecurity