Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams27 Security Engineers142 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All27 Incident142 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

27 articles in Developers · Clear filtersSort byNewest·Trending

Self-Propagating npm Malware Steals Credentials, Publishes More Malware

Self-Propagating npm Malware Steals Credentials, Publishes More Malware

What Happened The CanisterSprawl malware campaign compromised npm packages to steal sensitive data from developer machines, such as tokens and API keys. It then used these credentials to publish more

For DevelopersRead article

Axios NPM Package Breach: When 9 Million Weekly Downloads Meet a Sophisticated Compromise

Axios NPM Package Breach: When 9 Million Weekly Downloads Meet a Sophisticated Compromise

What Happened The NPM package for Axios was briefly compromised this week. Axios is a JavaScript HTTP client library with approximately 9 million weekly downloads, making it one of the most widely use

For DevelopersRead

Malicious npm Packages Stole Credentials from 8,000 Weekly Downloads

Malicious npm Packages Stole Credentials from 8,000 Weekly Downloads

Scope - What This Guide Covers This guide provides detection, prevention, and response strategies for supply chain attacks targeting package registries. It includes steps for securing your dependency

For DevelopersRead

16 npm Packages Compromised in Self-Propagating Supply Chain Attack

16 npm Packages Compromised in Self-Propagating Supply Chain Attack

What Happened On April 21, 2025, attackers published a malicious version of the pgserve package from Namastex Labs. Within days, 16 packages from the same publisher were compromised. The attack used a

For DevelopersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Your Dependency Update Just Broke Authentication: A Post-Patch Validation Checklist

Your Dependency Update Just Broke Authentication: A Post-Patch Validation Checklist

A critical vulnerability with a CVSS score of 9.1 appeared in ASP.NET Core s Data Protection Library—not from a zero-day exploit, but from a Microsoft update. CVE-2026-40372 affects authentication tok

For DevelopersRead

ASP.NET Core's CVSS 9.1 Privilege Escalation: A Cryptographic Verification Failure

ASP.NET Core's CVSS 9.1 Privilege Escalation: A Cryptographic Verification Failure

What Happened A critical vulnerability in Microsoft.AspNetCore.DataProtection allowed attackers to escalate privileges to SYSTEM level on affected servers. The flaw, tracked as CVE-2026-40372 with a C

For DevelopersRead

Code-Signing Certificates Revoked After Supply Chain Compromise

Code-Signing Certificates Revoked After Supply Chain Compromise

Incident Overview OpenAI is rotating all of its macOS code-signing certificates and will fully revoke them on May 8, 2026, following a supply chain attack involving a malicious version of the Axios pa

For DevelopersRead

Patching the protobuf.js RCE Vulnerability: A Step-by-Step Response Plan

Patching the protobuf.js RCE Vulnerability: A Step-by-Step Response Plan

A remote code execution vulnerability in protobuf.js (GHSA-xq3m-2v4x-88gg) affecting versions 8.0.0/7.5.4 and lower allows attackers to inject malicious code through unsafe dynamic code generation. If

For DevelopersRead

Angular SSR Vulnerability Exposes Internal Networks Through Header Manipulation

Angular SSR Vulnerability Exposes Internal Networks Through Header Manipulation

Your Angular application can inadvertently become a tool for attackers to map your internal infrastructure. CVE-2026-27739 highlights how a single oversight in HTTP header validation can turn server-s

For DevelopersRead

Package Manager Security: A Four-Stage Implementation Playbook

Package Manager Security: A Four-Stage Implementation Playbook

Every npm install or pip install you run pulls code from strangers into your production systems. ENISA s Technical Advisory for Secure Use of Package Managers (March 2026) breaks dependency management

For DevelopersRead

Malicious Packages on Packagist: A Detection and Response Reference

Malicious Packages on Packagist: A Detection and Response Reference

Scope This guide focuses on detecting, preventing, and remediating malicious packages in PHP Composer dependency chains, specifically targeting threats from Packagist . It covers reconnaissance method

For DevelopersRead

Should You Update Chrome Every Two Weeks?

Should You Update Chrome Every Two Weeks?

Starting September 2026, Chrome will move to a two-week release cycle with version 153. If you re managing web applications in production, you need a clear decision framework for how your team respond

For DevelopersRead

Tuning AI Response Guardrails Without Breaking User Trust

Tuning AI Response Guardrails Without Breaking User Trust

Scope This guide addresses the challenge of configuring AI model behavior in production systems to balance safety controls with usable responses. You ll find practical frameworks for evaluating conver

For DevelopersRead

"We generate SBOMs, but nobody looks at them" — fixing the gap between SBOM creation and action

"We generate SBOMs, but nobody looks at them" — fixing the gap between SBOM creation and action

Teams often find themselves generating Software Bill of Materials (SBOMs) without knowing how to use them effectively. They might have set up SBOM tooling in their CI/CD pipeline, generating thousands

For DevelopersRead

70% of Critical Vulns Come From Memory Issues — Here's What One Team Actually Did

70% of Critical Vulns Come From Memory Issues — Here's What One Team Actually Did

The Challenge A platform engineering team managing a 15-year-old C++ codebase faced a directive from their CISO: reduce memory-safety vulnerabilities by Q3 or plan a multi-year rewrite. The system pro

For DevelopersRead

Malicious Packages Downloaded 54,500 Times: Your Dependency Vetting Protocol

Malicious Packages Downloaded 54,500 Times: Your Dependency Vetting Protocol

Scope This guide outlines the technical controls and verification steps your team needs when using packages from NuGet , npm , and similar public repositories. It includes detection methods, repositor

For DevelopersRead

Showing 1-16 of 27 articles

PreviousPage 1 of 2Next