Expert perspectives on application security, compliance, and emerging threats
IncidentOn the morning after JFrog disclosed CVE-2026-82329, attackers were already scanning for vulnerable Artifactory instances. This authentication bypass flaw lets anyone gain admin-level access to your r
IncidentThe Problem In 2025, nearly one-third of known exploited vulnerabilities were exploited on or before the day they were publicly disclosed. This isn t an isolated incident, it s a widespread issue affe
IncidentOn a Tuesday morning, an unauthenticated attacker could walk into any public GitLab project and delete it. No credentials. No social engineering. Just a critical code injection vulnerability and an HT
IncidentOn July 10, 2025, security researcher Antoni Tremblay reported a vulnerability to JetBrains through their coordinated disclosure program. The flaw, tracked as CVE-2026-63077, allows unauthenticated re
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn January 13, 2025, AsyncAPI discovered that several of its npm packages had been compromised and were distributing malware. Three days later, Jscrambler reported a similar incident affecting its pac
IncidentOn July 14, a misconfigured GitHub Actions workflow turned AsyncAPI s npm packages into a distribution channel for credential-stealing malware. The attack lasted just over four hours, but the packages
IncidentThousands of organizations have been shipping vulnerable software, treating security as a post-development checkbox rather than an integrated practice. NIST SP 800-218 Version 1.1 was developed becaus
IncidentOn January 17, 2025, Gitea maintainers disclosed CVE-2026-20896, a critical authentication bypass in their Docker images. This flaw allows anyone to send a crafted HTTP header and gain admin access to
IncidentOverview The official Node.js Docker image from Docker Hub contains 567 vulnerable system libraries in its base layer. This is not due to an exploit or breach—it s the default state of one of the most
IncidentOn December 11, 2019, security researcher Daniel Ruf disclosed a vulnerability that allowed any malicious npm package to overwrite arbitrary files on your system during installation. No exploit code w
IncidentWhat Happened On February 9, 2021, security researcher Alex Birsan disclosed a dependency confusion attack that compromised build systems at 35 organizations, including major technology companies. The
IncidentWhat Happened On January 18, 2022, security researchers disclosed CVE-2022-24348 , a directory/path traversal vulnerability in Argo CD, a continuous delivery platform used to automate Kubernetes deplo
IncidentWhat Happened Socket discovered 19 compromised packages on PyPI, downloaded hundreds of thousands of times, delivering malware designed to steal developer credentials. These packages targeted scientif
IncidentOn December 18, 2024, security researchers disclosed a vulnerability in Microsoft Visual Studio Code that allowed attackers to steal GitHub OAuth tokens with a single user click. This attack exploited
IncidentWhat Happened Imperva researchers discovered two command injection vulnerabilities in Snyk s CLI and IDE plugins, both rated CVSSv3 5.8. These flaws allowed attackers to execute arbitrary code when de
IncidentA compromised Red Hat employee GitHub account led to malicious code being published across at least 32 npm packages under the @redhat-cloud-services namespace. These packages, with roughly 80,000 comb
