Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams753 Security Engineers759 Compliance Teams223 DevOps Leaders63 Developers31 CISOs17 IT Directors2

Topics:All753 Incident707 General188 Standards88 Research61 Guides34 Deadlines11 Vendor News4 Legal2

753 articles in Security Engineers · Clear filtersSort byNewest·Trending

Dependency Scanning Won't Save You

Dependency Scanning Won't Save You

The Conventional Wisdom Your security team runs dependency scanners in CI/CD. You ve configured Dependabot, Snyk, or another tool. When a pull request comes in, the scanner checks for known vulnerabil

For Security EngineersRead article

npm Vulnerability Spike: 83% Jump in One Year

npm Vulnerability Spike: 83% Jump in One Year

What Happened Between 2016 and 2017, the number of published vulnerabilities across tracked open-source ecosystems jumped 83 percent. The npm and Maven Central repositories — essential for JavaScript

For Security EngineersRead

event-stream: 3,931 Packages Backdoored Through One Maintainer Handoff

event-stream: 3,931 Packages Backdoored Through One Maintainer Handoff

What Happened In September 2018, the maintainer of event-stream —an npm package downloaded 2 million times per week—transferred ownership to a new contributor after months of social engineering. Withi

For Security EngineersRead

NIST Stopped Analyzing 40% of CVEs: What Broke

NIST Stopped Analyzing 40% of CVEs: What Broke

What Happened In 2024, the National Institute of Standards and Technology (NIST) s National Vulnerability Database (NVD) reduced its CVE enrichment operations, analyzing fewer vulnerabilities in depth

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

SharePoint RCE Under Active Attack: CVE-2026-45659

SharePoint RCE Under Active Attack: CVE-2026-45659

What Happened Attackers are exploiting CVE-2026-45659 , a remote code execution vulnerability in Microsoft SharePoint. This flaw allows an authenticated user with low privileges to execute arbitrary c

For Security EngineersRead

Kubernetes CVE-2018-1002105: The Privilege Escalation That Broke API Authentication

Kubernetes CVE-2018-1002105: The Privilege Escalation That Broke API Authentication

What Happened On December 3, 2018, the Kubernetes security team disclosed CVE-2018-1002105 , a critical vulnerability that allowed any authenticated user to escalate privileges and execute arbitrary c

For Security EngineersRead

ClickFix Defense Checklist for Security Teams

ClickFix Defense Checklist for Security Teams

Your endpoint detection just blocked another phishing email. Your web proxy flagged a suspicious download. But ClickFix attacks don t look like traditional malware delivery—they mimic legitimate troub

For Security EngineersRead

SharePoint RCE Under Active Exploit: CVE-2026-45659

SharePoint RCE Under Active Exploit: CVE-2026-45659

What Happened Microsoft SharePoint Server contains a deserialization vulnerability (CVE-2026-45659, CVSS 8.8) that allows authenticated attackers to execute arbitrary code remotely. CISA added this vu

For Security EngineersRead

AI Found 1,596 Bugs in Nine Weeks. Then What?

AI Found 1,596 Bugs in Nine Weeks. Then What?

What Happened Between late 2024 and early 2025, Anthropic s Claude Mythos Preview AI system identified 1,596 verified vulnerabilities in open-source projects through OSS-Fuzz over a nine-week period.

For Security EngineersRead

Exposed AI Endpoints: No Auth, Full Access

Exposed AI Endpoints: No Auth, Full Access

What Happened Threat actors have exploited publicly accessible AI endpoints that lacked authentication controls. These endpoints—serving large language models, image generation systems, and other AI c

For Security EngineersRead

Mastra AI's npm Workflow Breach: A Governance Failure

Mastra AI's npm Workflow Breach: A Governance Failure

What Happened In June 2026, attackers compromised the Mastra AI framework s npm publishing workflow. This breach allowed adversaries to control the package distribution mechanism, affecting the pipeli

For Security EngineersRead

Cursor's DuneSlide Flaws: Two Sandbox Escapes

Cursor's DuneSlide Flaws: Two Sandbox Escapes

What Happened Cato AI Labs discovered two critical vulnerabilities in Cursor, the AI code editor used by more than half the Fortune 500. Both flaws—CVE-2026-50548 and CVE-2026-50549, each rated 9.8 ou

For Security EngineersRead

Codecov Breach: 61 Days of Undetected Pipeline Access

Codecov Breach: 61 Days of Undetected Pipeline Access

What Happened In early 2021, an attacker modified a single line in Codecov s Bash Uploader script. This change caused the script to exfiltrate environment variables to an external server before execut

For Security EngineersRead

Adobe's July 2026 Patches: When AI Finds Flaws Faster Than Teams Can Fix Them

Adobe's July 2026 Patches: When AI Finds Flaws Faster Than Teams Can Fix Them

What Happened Adobe released emergency patches for seven vulnerabilities with CVSS scores of 10.0 across ColdFusion and Campaign Classic. These flaws, including CVE-2026-48286, represent the maximum s

For Security EngineersRead

Adobe Ships Seven Max-Severity Patches: What Went Wrong

Adobe Ships Seven Max-Severity Patches: What Went Wrong

Overview of the Vulnerabilities Adobe has released patches for seven maximum-severity vulnerabilities in ColdFusion and Campaign Classic. These vulnerabilities enable remote code execution through att

For Security EngineersRead

AI Agent Wrote Malicious Code from Fake Bug Report

AI Agent Wrote Malicious Code from Fake Bug Report

Incident Overview An attacker exploited AI coding agents using a technique called Agentjacking. This attack involves submitting fake bug reports with embedded instructions. The AI agent processes thes

For Security EngineersRead

Showing 177-192 of 753 articles

PreviousPage 12 of 48Next