Blog
One-Line Change to RCE: How Easily a Java Deserialization Flaw Is Introduced
A one-line move in an Apache Tomcat refactor made cluster encryption fail open, exposing unfiltered readObject() sink to unauthenticated RCE (CVE-2026-34486).
Blog
Insights on application security, IAST, RASP, and securing AI-generated code from the Waratek team.
Blog
AI Broke the Deserialization Threat Model
AI now discovers Java deserialization gadget chains in seconds, breaking blocklist and allowlist defenses. Learn why runtime …
Blog
Turning Your QA Team into Security Heroes (Without Adding a Single Task)
How Waratek IAST runs inside existing JUnit and Selenium test suites to evaluate enterprise Java code during normal QA runs, with …
Blog
Can We Secure the Code Pipeline in an Era of Autonomous AI Vulnerabilities?
Explores how AI models can autonomously insert vulnerabilities into code and how Waratek IAST and RASP together detect and block …
More Stories
Blog
Is Autonomous Security The Fuel for AI Innovation?
IAST and RASP let organizations pair fast AI development with continuous security rather than …
Blog
Can We Bridge the 42% Perception Gap? Aligning the C-Suite and the SOC
How Waratek unifies IAST and RASP to close the 42% SLA perception gap between executives and …
Blog
Remediation Crisis: Why 62% of AI Flaws Go Unfixed
62% of high-risk AI vulnerabilities go unfixed because traditional patching can't keep up with …
Blog
Waratek IAST + RASP is Insurance Against AI Risk
As AI-generated code floods the software lifecycle, Waratek's IAST and RASP provide a dual-layer …
Blog
Mythos Doesn’t Need CVEs: Defending against AI Zero-Days
How Anthropic's Claude Mythos collapses exploit development from weeks to minutes, and why Waratek …
Blog
Runtime Reality vs AI Hallucinations in AppSec
AI-driven static analysis hallucinates vulnerabilities that don't exist, fueling developer fatigue. …
Blog
Is Your Security Blind to the Party Inside Your App?
Using a ballroom analogy to explain why SAST and DAST only see the outside of your application, and …
Blog
Why Your Security Team Needs to Move at AI Speed
New vulnerabilities and zero-days now emerge faster than human teams can manually patch them. …
Blog
Oracle Releases April 2026 Critical Patch Update
Oracle Communications, Fusion Middleware, MySQL, E-Business Suite and Financial Services lead 483 …
Blog
Moving at the Speed of Thought & No Security Debt
AI-assisted 'vibe coding' introduces security flaws in nearly 45% of generated code. Waratek IAST …
Blog
Goldilocks Security: The “Just Right” AppSec Tool
Why SAST is too noisy, DAST is too shallow, and IAST is finally hitting the sweet spot for modern …
Blog
Trust, but Verify: AI Code Supply Chain Security
AI-generated code and sprawling software supply chains create a false sense of security. Waratek …