Expert perspectives on application security, compliance, and emerging threats
IncidentA vulnerability fix in a widely-used Golang JWT package was never merged into the version most developers used. This oversight left projects exposed to authentication bypass, despite the existence of
IncidentWhat Happened Novo Nordisk experienced a security breach when an attacker accessed its systems through a leaked GitHub token. This token, a credential for automated systems to interact with the compan
IncidentWhat Happened Your developers store credentials on their laptops. Git history, environment files, configuration snippets, and API keys are all vulnerable on machines that connect to public WiFi, run u
IncidentWhat Happened F5 released emergency security patches for critical vulnerabilities in NGINX web server modules. Two vulnerabilities—CVE-2026-42530 and CVE-2026-42055—allow unauthenticated remote attack
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn June 17, 2026, Sonatype researchers identified a supply chain attack targeting the Mastra AI framework. The attacker published a malicious npm package named easy-day-js , designed to mimic the popu
IncidentWhat Happened A mid-sized SaaS company discovered a critical remote code execution (RCE) vulnerability in their customer-facing API on day 14 of its exposure. The vulnerability came from an outdated d
IncidentThe Breach: A Summary In early 2020, attackers infiltrated SolarWinds build environment, embedding malicious code into the Orion platform update process. When SolarWinds released the compromised updat
IncidentWhat Happened A Java application using snakeyaml before version 1.26 processed a malicious YAML file, triggering a Denial of Service vulnerability. The attack exploited YAML s entity expansion feature
IncidentA vulnerability in the Google Cloud Vertex AI SDK allowed attackers to replace legitimate machine learning models with malicious ones—without needing credentials. Discovered by Palo Alto Networks Unit
IncidentWhat Happened Google s Vertex AI SDK for Python versions 1.139.0 and 1.140.0 had a design flaw allowing attackers to execute arbitrary code. The issue arose from predictable cloud storage bucket namin
IncidentWhat Happened In 2019, a former AWS employee exploited a server-side request forgery (SSRF) vulnerability in Capital One s web application firewall configuration to access the EC2 instance metadata se
IncidentOn June 17, 2026, an attacker accessed a dormant npm account belonging to a former Mastra contributor. Within hours, they republished every package in the @mastra scope with a malicious dependency tha
IncidentOn June 3, 2026, the Joomla project released version 2.9.99.5 of its Content Editor (JCE) to patch CVE-2026-48907 , a vulnerability allowing arbitrary PHP code execution. CISA added this flaw to its K
IncidentWhat Happened On June 17, 2026, an attacker compromised a contributor account in the Mastra namespace and published 144 malicious npm packages within 88 minutes. Each package included a dependency on
IncidentOn January 14, 2025, security researchers disclosed SearchLeak, a three-stage prompt injection attack that exploited Microsoft Copilot s web search integration to exfiltrate user data through a single
IncidentOn June 13, Sansec disclosed a coordinated attack against three WordPress plugins owned by Awesome Motive: PushEngage, OptinMonster, and TrustPulse. Attackers modified JavaScript files served through
