Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams39 Security Engineers142 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All39 Incident142 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

39 articles in Compliance Teams · Incident · Clear filtersSort byNewest·Trending

Axios Supply Chain Attack: How 300 Million Weekly Downloads Nearly Became a Backdoor

What Happened On March 31, 2026, attackers published malicious versions of axios —a JavaScript HTTP client library with over 300 million weekly downloads—to the npm registry. The compromised packages

For Compliance TeamsRead article

6,500 Unpatched ActiveMQ Instances: When AI Finds Flaws Faster Than You Can Fix Them

Incident

3 min read

6,500 Unpatched ActiveMQ Instances: When AI Finds Flaws Faster Than You Can Fix Them

Summary of the Incident A critical remote code execution vulnerability in Apache ActiveMQ was discovered using AI-assisted analysis in about 10 minutes. This vulnerability affects versions before 5.19

For Compliance TeamsRead

Bitwarden CLI Supply Chain Attack: A 95-Minute Window That Exposed Thousands of Secrets

Incident

5 min read

Bitwarden CLI Supply Chain Attack: A 95-Minute Window That Exposed Thousands of Secrets

What Happened On April 22, 2026, attackers published a compromised version of the Bitwarden command-line interface (version @bitwarden/ [email protected] ) to npm. The malicious code, embedded in a file na

For Compliance TeamsRead

Bitwarden CLI Hijacked for 90 Minutes: A CI/CD Pipeline Breach Teardown

Incident

4 min read

Bitwarden CLI Hijacked for 90 Minutes: A CI/CD Pipeline Breach Teardown

On April 22, 2025, developers who updated the Bitwarden CLI to version 2026.4.0 installed malware designed to exfiltrate their most sensitive credentials. The window was narrow—just over 90 minutes—bu

For Compliance TeamsRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Hackers Compromised a Security Tool to Steal the Secrets It Was Scanning

Incident

5 min read

Hackers Compromised a Security Tool to Steal the Secrets It Was Scanning

What Happened On April 22, 2026, attackers replaced legitimate Docker images of Checkmarx s KICS (Keeping Infrastructure as Code Secure) tool with malicious versions. KICS is an open-source scanner th

For Compliance TeamsRead

12,000 Flowise Instances Compromised Through Maximum-Severity RCE Flaw

Incident

4 min read

12,000 Flowise Instances Compromised Through Maximum-Severity RCE Flaw

What Happened A critical remote code execution vulnerability in Flowise AI—an open-source platform for building AI agents—is being actively exploited. CVE-2025-59528 carries a CVSS score of 10.0, the

For Compliance TeamsRead

12,000 AI Workflow Instances Running With a Known Critical Flaw

Incident

4 min read

12,000 AI Workflow Instances Running With a Known Critical Flaw

What Happened Between late January and early February 2025, security researchers at VulnCheck detected active exploitation of CVE-2025-59528 , a JavaScript injection vulnerability in Flowise, a low-co

For Compliance TeamsRead

500,000 Vulnerabilities Narrowed to 14 Critical Paths

Incident

3 min read

500,000 Vulnerabilities Narrowed to 14 Critical Paths

The Problem Your security team, using CrowdStrike , encountered a daunting challenge: 500,000 vulnerability findings flagged by the scanner. Each finding had a CVSS score demanding attention. Patching

For Compliance TeamsRead

Prompt Injection Flaws in Salesforce Agentforce and Microsoft Copilot: A Security Teardown

Incident

4 min read

Prompt Injection Flaws in Salesforce Agentforce and Microsoft Copilot: A Security Teardown

Two recently fixed prompt injection vulnerabilities in Salesforce Agentforce and Microsoft Copilot could have allowed external attackers to leak sensitive data from enterprise systems. Here s what hap

For Compliance TeamsRead

Axios NPM Package Hijacked: Three Hours That Exposed Your Dependency Stack

Incident

5 min read

Axios NPM Package Hijacked: Three Hours That Exposed Your Dependency Stack

What Happened On March 30, 2026, attackers compromised the Axios NPM package by taking over a maintainer s account. Axios, a widely used HTTP client library in JavaScript, was injected with malicious

For Compliance TeamsRead

Security Fix Exists, But Your Users Are Still Vulnerable

Incident

4 min read

Security Fix Exists, But Your Users Are Still Vulnerable

What Happened Adversa discovered a vulnerability in Claude Code that allows attackers to bypass security controls by submitting more than 50 subcommands in a single request. When the system encounters

For Compliance TeamsRead

A Security Scanner Becomes the Attack Vector: The Trivy Supply Chain Breach

Incident

4 min read

A Security Scanner Becomes the Attack Vector: The Trivy Supply Chain Breach

On March 19, 2026, TeamPCP compromised Aqua Security s Trivy vulnerability scanner—a tool millions of developers rely on to find security flaws. The attackers didn t exploit a zero-day in the scanner

For Compliance TeamsRead

56% of Vulnerable Magento Stores Hit Within 10 Days

Incident

5 min read

56% of Vulnerable Magento Stores Hit Within 10 Days

What Happened Mass exploitation of the PolyShell vulnerability in Magento Open Source and Adobe Commerce began on March 19th. Within days, attackers compromised 56.7% of all vulnerable stores. The att

For Compliance TeamsRead

1,000 SaaS Environments Compromised Through a Security Scanner

Incident

4 min read

1,000 SaaS Environments Compromised Through a Security Scanner

What Happened Between late 2024 and early 2025, attackers compromised the Trivy vulnerability scanner s supply chain by stealing npm publish tokens. They backdoored more than 29 packages that Trivy de

For Compliance TeamsRead

15,000 Magento Stores Hit by Defacement: PolyShell Vulnerability Teardown

Incident

4 min read

15,000 Magento Stores Hit by Defacement: PolyShell Vulnerability Teardown

What Happened Security researchers at Sansec discovered a critical vulnerability in Magento s REST API, designated PolyShell, that allows attackers to upload malicious files to e-commerce sites withou

For Compliance TeamsRead

Trivy Scanner Breach: When 32,000 GitHub Stars Became a Liability

Incident

4 min read

Trivy Scanner Breach: When 32,000 GitHub Stars Became a Liability

What Happened On March 19, 2026, attackers compromised Aqua Security s Trivy vulnerability scanner through GitHub Actions. Trivy, with over 32,000 stars on GitHub, is a critical dependency in thousand

For Compliance TeamsRead

Showing 17-32 of 39 articles

PreviousPage 2 of 3Next