Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams344 Security Engineers458 Compliance Teams158 DevOps Leaders38 Developers28 CISOs8 IT Directors2

Topics:All344 Incident448 General92 Standards82 Research31 Guides26 Deadlines7 Vendor News4 Legal2

344 articles in Security Engineers · Incident · Clear filtersSort byNewest·Trending

Backdoor Triggered by Input Length Alone

Incident

Latest

4 min read

Backdoor Triggered by Input Length Alone

On February 19, 2025, Microsoft and the Institute of Science Tokyo published research documenting a new class of AI model backdoor that bypasses every content-based security control you re running. Th

For Security EngineersRead article

Five Vendors, Ten Days: Patch Chaos in January 2026

Incident

4 min read

Five Vendors, Ten Days: Patch Chaos in January 2026

Between January 14 and January 24, 2026, five enterprise software vendors released patches for critical vulnerabilities with CVSS scores ranging from 9.1 to 9.6. If your team manages any combination o

For Security EngineersRead

Incident

5 min read

Three Package Repos Hit in 48 Hours

What Happened Between late 2024 and early 2025, three separate credential-harvesting campaigns targeted npm , PyPI, and Docker Hub within a 48-hour period. These attacks followed a common pattern: com

For Security EngineersRead

Image Injection Attack Defeats Vision-Language Models

Incident

4 min read

Image Injection Attack Defeats Vision-Language Models

A research team at Xidian University has demonstrated a new type of attack that manipulates multimodal AI systems through altered images. This attack, called CrossMPI, achieved a 66.36% average succes

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

NGINX CVE-2026-42945: Exploitation Teardown

Incident

4 min read

NGINX CVE-2026-42945: Exploitation Teardown

What Happened Attackers are actively exploiting CVE-2026-42945 , a heap buffer overflow in NGINX s ngx_http_rewrite_module . VulnCheck detected exploitation attempts against their honeypot networks. T

For Security EngineersRead

Incident

5 min read

AI Flagged 27 Bugs. Only 7 Got Fixed.

What Happened The DARPA Artificial Intelligence Cyber Challenge (AIxCC) concluded with a $30,500,000 prize pool, showcasing AI s potential in vulnerability detection. Seven teams deployed AI systems a

For Security EngineersRead

LLM Code Scanner Generates Working Exploits

Incident

4 min read

LLM Code Scanner Generates Working Exploits

SecureLayer7 released Sandyaa in late 2024 under an MIT license. This tool uses large language models to scan source code for vulnerabilities and then writes exploit code to prove they re real. Within

For Security EngineersRead

Admin Access in 7,400 Attacks: The Burst Statistics Plugin Breach

Incident

5 min read

Admin Access in 7,400 Attacks: The Burst Statistics Plugin Breach

A critical authentication bypass in the Burst Statistics WordPress plugin gave attackers admin-level access to thousands of websites. Here s what happened, which controls failed, and what your team ne

For Security EngineersRead

40,000 WooCommerce Stores Hit by Checkout Skimmer

Incident

4 min read

40,000 WooCommerce Stores Hit by Checkout Skimmer

What Happened Between early December 2024 and January 16, 2025, attackers exploited a critical vulnerability in FunnelKit s Funnel Builder plugin to inject malicious JavaScript into WooCommerce checko

For Security EngineersRead

AI Agents Found a 15-Year-Old Bug in 48 Hours

Incident

3 min read

AI Agents Found a 15-Year-Old Bug in 48 Hours

Discovery of a Long-Overlooked Vulnerability An AI-powered security agent uncovered a vulnerability that had eluded human researchers for over a decade, exploiting it within 48 hours of deployment. Th

For Security EngineersRead

Incident

4 min read

Mistral AI Breach: 450 Repos for $25K

What Happened TeamPCP compromised Mistral AI s codebase management system, extracting nearly 450 repositories. They are selling the complete source code for $25,000 on underground forums, threatening

For Security EngineersRead

TanStack Supply Chain Attack: Two Devices, One Pipeline, Total Credential Rotation

Incident

4 min read

TanStack Supply Chain Attack: Two Devices, One Pipeline, Total Credential Rotation

What Happened In early 2025, threat actor TeamPCP compromised TanStack s distribution infrastructure and released trojanized versions of npm and PyPI SDKs. Two OpenAI employee devices installed these

For Security EngineersRead

One Million Sites, Two Flaws, Subscriber Access

Incident

4 min read

One Million Sites, Two Flaws, Subscriber Access

What Happened On May 12, Wordfence disclosed two vulnerabilities in the Avada Builder WordPress plugin, which has an estimated one million active installations. CVE-2026-4782 allows arbitrary file rea

For Security EngineersRead

40,000 Sites Running Vulnerable Checkout Code

Incident

4 min read

40,000 Sites Running Vulnerable Checkout Code

A vulnerability in the Funnel Builder WordPress plugin allowed attackers to inject malicious JavaScript into WooCommerce checkout pages and harvest credit card data in real time. The plugin, active on

For Security EngineersRead

Incident

4 min read

AI Found an 18-Year-Old RCE in Nginx

Discovery of a Long-Standing Vulnerability In early 2025, DepthFirst AI discovered CVE-2026-42945, a heap buffer overflow vulnerability in Nginx s ngx_http_rewrite_module . This flaw had existed undet

For Security EngineersRead

Credential Theft Through npm: The node-ipc Compromise

Incident

4 min read

Credential Theft Through npm: The node-ipc Compromise

What Happened On March 7, 2025, security researchers at Socket detected malicious code in three versions of node-ipc , an npm package with more than 690,000 weekly downloads. The compromised versions—

For Security EngineersRead

Showing 177-192 of 344 articles

PreviousPage 12 of 22Next