Fluid Attacks Blog

Attackers took about USD 6.3B from Binance through a DevOps laptop. See the attack chain and the links that you can test in your own systems.

Your fraud team tracks losses. Your engineers track vulnerabilities. Often it’s the same flaw. Break the silo and fight security and fraud risk together.

Researchers directing AI agents found PHP2Shell, two PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619). See which PHP versions fix them.

An auditor never asks about your CVE, only about the control. A free vulnerability database that links each CVE to its fix and 60+ standards.

Some BSides LV talks never get recorded: no cameras, no phones, no press. These are the six that stuck with me most — two of them happened behind that door.

Codex and Claude Code missed 9 in 10 real vulnerabilities. Fluid Attacks' AI SAST caught 72% — at a lower cost per finding.

Certifying AI governance is now possible. See what ISO 42001 actually asks of security teams.

AI systems are now helping develop other AI systems. That shifts the attack surface in ways most enterprise security programs haven't yet accounted for.