Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams344 Security Engineers458 Compliance Teams158 DevOps Leaders38 Developers28 CISOs8 IT Directors2

Topics:All344 Incident448 General92 Standards82 Research31 Guides26 Deadlines7 Vendor News4 Legal2

344 articles in Security Engineers · Incident · Clear filtersSort byNewest·Trending

Incident

Latest

4 min read

5,561 Repos Compromised in Six Hours

An attacker pushed 5,718 malicious commits across 5,561 GitHub repositories in just six hours. This campaign, known as Megalodon, didn t rely on a zero-day or novel vulnerability. Instead, it exploite

For Security EngineersRead article

WordPress Plugin Backdoor: 300 Zero-Days in 72 Hours

Incident

4 min read

WordPress Plugin Backdoor: 300 Zero-Days in 72 Hours

What Happened Between late 2024 and early 2025, TrendAI and CHT Security used an AI-driven static analysis system to scan WordPress plugins. This system uncovered over 300 critical zero-day vulnerabil

For Security EngineersRead

Two Major Breaches, One Supply Chain Failure

Incident

5 min read

Two Major Breaches, One Supply Chain Failure

On January 15, 2025, GitHub disclosed that attackers accessed internal repositories and exfiltrated source code. Days later, Grafana Labs confirmed a similar breach. Both incidents traced back to a su

For Security EngineersRead

Two KEV Additions, One Lesson: Patch Before Threat Actors Do

Incident

4 min read

Two KEV Additions, One Lesson: Patch Before Threat Actors Do

What Happened Between May 15 and May 21, 2025, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. CVE-2025-34291, an origin valid

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Incident

3 min read

Treasury Breach: A 15-Year-Old Flaw

What Happened In December 2024, state-sponsored attackers exploited a PostgreSQL SQL injection zero-day to infiltrate the US Treasury. This vulnerability allowed them to bypass authentication controls

For Security EngineersRead

ChromaDB CVE-2026-45829: Race Condition to RCE

Incident

3 min read

ChromaDB CVE-2026-45829: Race Condition to RCE

Overview of the Vulnerability ChromaDB versions 1.0.0 through 1.5.8 have a critical vulnerability allowing unauthenticated remote code execution. The flaw, tracked as CVE-2026-45829, exploits a race c

For Security EngineersRead

1,467 Malicious AI Skills Found in ClawHub

Incident

5 min read

1,467 Malicious AI Skills Found in ClawHub

An AI agent you deploy to automate customer support queries suddenly starts leaking API keys to an external server. Your incident response team traces it back to a helpful skill you installed three we

For Security EngineersRead

Google's 72 Open-Source Fixes: What CodeMender's Integration Reveals About AI Security Governance

Incident

3 min read

Google's 72 Open-Source Fixes: What CodeMender's Integration Reveals About AI Security Governance

Introduction Google s integration of CodeMender, an AI-powered vulnerability remediation agent, into the Gemini Enterprise Agent Platform marks a strategic shift in AI security governance. This move d

For Security EngineersRead

Next.js Middleware Bypass: CVE-2026-44575

Incident

4 min read

Next.js Middleware Bypass: CVE-2026-44575

What Happened CVE-2026-44575 allows attackers to bypass middleware-based authorization controls in Next.js App Router applications through manipulated request paths. The vulnerability affects Next.js

For Security EngineersRead

Incident

4 min read

3,800 Repos Stolen in 18 Minutes

On May 18, 2026, GitHub disclosed a breach of its internal repositories. The attack vector: a trojanized VS Code extension called Nx Console, maintained by Narwhal Technologies. The compromised versio

For Security EngineersRead

3,800 GitHub Repos Breached via VS Code Extension

Incident

4 min read

3,800 GitHub Repos Breached via VS Code Extension

What Happened Attackers compromised the Nx Console VS Code extension and published a malicious version to the Visual Studio Marketplace. This version exfiltrated authentication tokens from developers

For Security EngineersRead

PolinRider Used Blockchain to Hide Malware in npm Package

Incident

5 min read

PolinRider Used Blockchain to Hide Malware in npm Package

What Happened Between late 2024 and early 2025, attackers compromised two versions of the npm package @common-stack/generate-plugin (9.0.2-alpha.21 and 9.0.2-alpha.22). The package, which sees over 1,

For Security EngineersRead

Drupal CVE-2026-9082: When Anonymous Users Get RCE

Incident

3 min read

Drupal CVE-2026-9082: When Anonymous Users Get RCE

What Happened Drupal recently released emergency security updates for six supported versions to patch CVE-2026-9082 , a vulnerability that allows anonymous users to execute remote code on sites using

For Security EngineersRead

When Equifax Ignored Its Own DAST Findings

Incident

3 min read

When Equifax Ignored Its Own DAST Findings

Equifax s Security Oversight In 2017, Equifax suffered a massive data breach that exposed the personal information of 147 million people. The breach was due to an unpatched Apache Struts vulnerability

For Security EngineersRead

Drupal's CVE-2026-9082: SQL Injection Through the Dependency Stack

Incident

3 min read

Drupal's CVE-2026-9082: SQL Injection Through the Dependency Stack

Overview of the Vulnerability Drupal has released emergency patches for CVE-2026-9082, a critical SQL injection vulnerability affecting sites using PostgreSQL. This issue required coordinated patches

For Security EngineersRead

One Unrotated Token: Grafana's GitHub Breach

Incident

5 min read

One Unrotated Token: Grafana's GitHub Breach

What Happened On May 1, 2025, Grafana detected unauthorized access to its private GitHub repositories. The attacker exploited a single GitHub workflow token that should have been rotated weeks earlier

For Security EngineersRead

Showing 145-160 of 344 articles

PreviousPage 10 of 22Next