Expert perspectives on application security, compliance, and emerging threats
IncidentThe Breach: A Summary In early 2020, attackers infiltrated SolarWinds build environment, embedding malicious code into the Orion platform update process. When SolarWinds released the compromised updat
IncidentWhat Happened A Java application using snakeyaml before version 1.26 processed a malicious YAML file, triggering a Denial of Service vulnerability. The attack exploited YAML s entity expansion feature
IncidentA vulnerability in the Google Cloud Vertex AI SDK allowed attackers to replace legitimate machine learning models with malicious ones—without needing credentials. Discovered by Palo Alto Networks Unit
IncidentWhat Happened Google s Vertex AI SDK for Python versions 1.139.0 and 1.140.0 had a design flaw allowing attackers to execute arbitrary code. The issue arose from predictable cloud storage bucket namin
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened In 2019, a former AWS employee exploited a server-side request forgery (SSRF) vulnerability in Capital One s web application firewall configuration to access the EC2 instance metadata se
IncidentOn June 17, 2026, an attacker accessed a dormant npm account belonging to a former Mastra contributor. Within hours, they republished every package in the @mastra scope with a malicious dependency tha
IncidentOn June 3, 2026, the Joomla project released version 2.9.99.5 of its Content Editor (JCE) to patch CVE-2026-48907 , a vulnerability allowing arbitrary PHP code execution. CISA added this flaw to its K
IncidentWhat Happened On June 17, 2026, an attacker compromised a contributor account in the Mastra namespace and published 144 malicious npm packages within 88 minutes. Each package included a dependency on
IncidentOn January 14, 2025, security researchers disclosed SearchLeak, a three-stage prompt injection attack that exploited Microsoft Copilot s web search integration to exfiltrate user data through a single
IncidentOn June 13, Sansec disclosed a coordinated attack against three WordPress plugins owned by Awesome Motive: PushEngage, OptinMonster, and TrustPulse. Attackers modified JavaScript files served through
IncidentOn May 2, 2025, BerriAI released LiteLLM v1.83.14-stable, fixing a vulnerability chain that allowed low-privilege users to execute arbitrary code on the AI gateway server. Obsidian Security disclosed
IncidentWhat Happened Attackers are actively exploiting CVE-2026-5027, a path traversal vulnerability in Langflow that allows arbitrary file writes and remote code execution. The patch shipped in version 1.9.
IncidentIncident Overview An open-source project with over 35,000 GitHub stars experienced a full account takeover due to a vulnerability that many security tools would have flagged as low-priority or ignored
IncidentBetween late 2024 and early 2025, Snyk identified eight malicious npm packages that exploited pre- and post-install scripts to execute arbitrary commands on developer machines. Although these packages
IncidentWhat Happened Security researchers Mario Stathako and colleagues found that npm s package aliasing feature—intended to let developers install packages under different names—creates a new risk for depe
IncidentThe Threat of IDE Extensions Snyk s security research team discovered remote code execution vulnerabilities in Visual Studio Code extensions available through the official marketplace. A significant e
