Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened ShapedPlugin, a vendor of premium WordPress plugins, experienced a supply chain attack that injected backdoor code into official releases of multiple Pro plugins. This affected Product S
IncidentYour organization has just deployed its first AI agent into production. It authenticates through your existing identity provider (IdP), accesses your cloud storage, and queries your databases — the sa
IncidentA Zip Slip vulnerability in the Golang package go-rpmutils could have allowed attackers to write arbitrary files outside intended directories during archive extraction. The vulnerability, tracked as C
IncidentWhat Happened In 2020, researcher Yeting Li discovered a Regular Expression Denial of Service (REDoS) vulnerability in UAParser.js, a widely-used JavaScript library for parsing user agent strings. The
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened ShapedPlugin s distribution system was compromised, allowing attackers to inject malware into three premium WordPress plugins via the official update mechanism. The backdoor impersonated
IncidentImmediate Action Required for Federal Agencies The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-48907 to its Known Exploited Vulnerabilities Catalog, mandating federal ag
IncidentOn December 18, 2024, the European Commission proposed the Cybersecurity Act 2.0 (CSA 2.0). While intended to enhance security, the regulation introduces a vendor classification mechanism that uses ge
IncidentOn a Friday evening in late 2024, websites using OptinMonster began serving malicious JavaScript to visitors. The attack originated from a compromised content delivery network (CDN), not OptinMonster
IncidentWhat Happened The Federal Trade Commission (FTC) issued a public warning to companies: if you fail to protect consumer data from exposure due to Log4j vulnerabilities, they will pursue legal action. T
IncidentOn January 9, 2022, developers worldwide faced a sudden disruption: their builds were broken. This wasn t due to a zero-day exploit or a sophisticated supply chain attack, but rather a maintainer inte
IncidentWhat Happened In December 2021, a critical vulnerability in Apache Log4j—a widely used Java logging library—allowed attackers to execute arbitrary code on vulnerable systems. This exploit, known as CV
IncidentWhat Happened Between late 2025 and June 11, 2026, attackers executed a supply chain attack against the Arch User Repository (AUR). They adopted orphaned packages—projects whose original maintainers h
IncidentOn March 15, 2022, thousands of developers running npm install unknowingly pulled malicious code into their projects. The maintainer of node-ipc—a widely-used inter-process communication library—intro
IncidentSummary of Events For over 15 years, npm allowed packages to execute arbitrary code during installation through preinstall, install, and postinstall scripts. These scripts ran automatically whenever a
IncidentOn March 30, 2022, researchers disclosed CVE-2022-22965, a critical remote code execution vulnerability in the Spring Framework. Within hours, proof-of-concept exploits circulated publicly. If your te
IncidentThe Discovery GitGuardian s analysis revealed an average of 150 secrets per developer machine. These secrets weren t found in repositories or CI/CD logs but on local workstations — hidden in shell his
