Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened A malicious npm package named electron-native-notify targeted users of Komodo s Agama cryptocurrency wallet. A GitHub user, sawlysawly, disclosed the threat via a public commit, triggeri
IncidentWhat Happened An attacker compromised the maintainer account for the Ruby gem strong_password and published version 0.0.7 containing remote code execution capabilities. Rubygems.org reported 537 downl
IncidentWhat Happened A Denial of Service vulnerability (CVSS 5.3) in the Axios JavaScript HTTP client allowed attackers to force applications to process content beyond configured limits. This flaw affected a
IncidentA remote code execution vulnerability lay hidden in Webmin for over a year, affecting versions 1.890 through 1.920. This wasn t a coding mistake — it was a deliberate insertion by a malicious actor wh
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Mozilla s Zero Day Investigative Network (0DIN) demonstrated an attack exploiting AI coding agents through legitimate-looking GitHub repositories. The repository contained no malicious c
IncidentWhat Happened Spring Boot version 2.1.7 shipped with jackson-databind 2.9.9, a JSON parsing library containing two high-severity deserialization vulnerabilities (CVE-2019-14379 and CVE-2019-14439). Th
IncidentWhat Happened Attackers are exploiting CVE-2026-12569 , a remote code execution vulnerability in PTC Windchill, to deploy web shells on vulnerable systems. The flaw has a CVSS score of 9.3. CISA added
IncidentWhat Happened SentinelLabs identified malware targeting MacOS systems that contains instructions designed to make LLM-assisted security products abort their analysis. The malware, detected under the r
IncidentWhat Happened On June 25, 2026, researchers identified a supply chain breach affecting the Leo Platform ecosystem on npm. Sonatype found 23 malicious package versions linked to the Shai-Hulud Miasma c
IncidentA supply chain attack targeting npm packages and GitHub Actions workflows revealed how attackers can now move across package ecosystems to harvest developer credentials at scale. The Miasma malware ca
IncidentIn January 2025, Polymarket users experienced a significant security breach when $3 million in cryptocurrency vanished from their wallets. The culprit? Malicious JavaScript injected through a third-pa
IncidentWhat Happened In August 2019, an attacker compromised a maintainer s RubyGems account for the rest-client library and inserted malicious code into versions 1.6.11 through 1.6.13. This backdoor allowed
IncidentWhat Happened Your .NET development team might spend weeks triaging vulnerability alerts from your software composition analysis (SCA) tool. Imagine your application pulls in 4,200 NuGet packages acro
IncidentWhat Happened Security researchers have found that modern LLMs rely heavily on role tags—such as system prompts and user designations—as their primary security framework. However, these tags do not pe
IncidentIn June 2019, Snyk discovered SQL injection vulnerabilities in Sequelize, a widely-used ORM library in the Node.js ecosystem. These flaws affected versions below 5.8.11 for MySQL and MariaDB, and vers
IncidentWhat Happened In November 2023, Spring Boot 2.7 reached end-of-life. If your organization is still using this version, you re dealing with 143 known CVEs across 79 projects in your dependency tree. Th
