Research & Threat Intel
eMudhra CA issued eight intermediate certificates whose private keys anyone could derive, and the flaw went undiscovered until October 2026. Here is how pinning your vetted root CAs narrows a mobile app’s trust store when CRL, OCSP and Certificate Transparency come after discovery.
AI helped researchers turn two critical PHP flaws into working exploits. A fully patched mobile app can still put users at risk if it talks to a vulnerable backend. Here is how to find those connections and fix them.
Fixing critical PHP CVEs with radare2, without recompiling or waiting for distro updates.
NowSecure found no detectable PQC code in 97% of 136,711 mobile apps. Learn how to inventory mobile cryptography and build a PQC migration plan.
NowSecure’s 2026 Mobile App Risk Management Survey found that 68% of organizations report having more than half their mobile codebase built from third-party SDKs. For most teams, the majority of what ships in their app is code they didn’t write, and mobile app security testing hasn’t caught up to that shift. Assessment practices haven’t kept […]
Before NowSecure fielded its 2026 Mobile App Risk Management (MARM) Survey, we ran an experiment most survey research skips. We asked three leading AI models, Claude Sonnet, ChatGPT and Gemini, to predict how senior mobile application security leaders would answer the survey. Then we compared those predictions with the survey responses. We weren’t asking AI […]
During its recent hackathon, NowSecure’s research and engineering teams built working prototypes of AI-powered tools spanning the mobile app security lifecycle: agentic reverse engineering and finding validation, real-device exploit confirmation, AI-generated mobile device management (MDM) policy guidance and dramatically expanded vulnerability database coverage. Each prototype built on NowSecure’s research, specialized mobile application security testing tooling […]
What the Transsion Telemetry Research Means for Mobile Security Transsion is the world’s fourth-largest smartphone manufacturer. Its brands — TECNO, Infinix, and itel — dominate markets across Africa, South Asia, Southeast Asia, and Latin America. Every one of these devices ships with a first-party Android telemetry framework: Athena for event collection and oneID for cross-app […]
Most vulnerability management programs are built on a simple assumption: vulnerabilities are discovered, assigned a CVE, analyzed, prioritized and remediated. A new federal audit suggests that model is under increasing strain. The National Vulnerability Database (NVD) backlog isn’t just a government process issue; it’s evidence that vulnerability volume, software supply-chain complexity and shrinking exploitation timelines […]
Key Finding: 1 in 4 AI-generated code samples contain at least one confirmed OWASP vulnerability — and mobile apps face elevated risk due to their distributed, client-side execution model, direct exposure to untrusted devices and attack surfaces traditional AppSec tools are not designed to evaluate. Developers are increasingly turning to AI coding assistants to speed […]