Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams344 Security Engineers458 Compliance Teams158 DevOps Leaders38 Developers28 CISOs8 IT Directors2

Topics:All344 Incident448 General92 Standards82 Research31 Guides26 Deadlines7 Vendor News4 Legal2

344 articles in Security Engineers · Incident · Clear filtersSort byNewest·Trending

Incident

Latest

5 min read

LLM-Driven Exploit Chains: No Incident Yet, But Here's What Failed

The Emerging Threat This isn t a traditional incident analysis because there isn t a specific breach to dissect. Instead, a new pattern is emerging in threat intelligence: adversaries are using large

For Security EngineersRead article

1,862 AI Servers Running With No Authentication

Incident

3 min read

1,862 AI Servers Running With No Authentication

What Happened In early 2025, security researchers at Knostic discovered 1,862 Model Context Protocol (MCP) servers exposed to the public internet without any authentication controls. These servers all

For Security EngineersRead

First AI-Generated Zero-Day Hits Production

Incident

5 min read

First AI-Generated Zero-Day Hits Production

Google s Threat Intelligence Group has disclosed a new threat your security program wasn t designed to handle: a working exploit developed entirely by AI. This vulnerability—a 2FA bypass implemented i

For Security EngineersRead

Incident

4 min read

Zero-Day Built by AI: What Went Wrong

Google s Threat Intelligence Group has documented a zero-day exploit that shows signs of AI-assisted development. This exploit was deployed by a criminal group against a popular open-source web-based

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

1.6M Ollama Servers Found Running Without Auth

Incident

4 min read

1.6M Ollama Servers Found Running Without Auth

What Happened Intruder s security team scanned over 1 million exposed AI services across the public internet, uncovering widespread security failures in AI infrastructure. The scan revealed that 31% o

For Security EngineersRead

Five Malicious Rust Crates Steal Secrets from CI/CD

Incident

3 min read

Five Malicious Rust Crates Steal Secrets from CI/CD

Summary of the Incident Between late February and early March 2026, attackers published five malicious Rust crates to crates.io disguised as time utility libraries. These packages executed code during

For Security EngineersRead

Incident

5 min read

Secret Leaked in MCP Server Config File

You re building an AI coding agent using GitHub s MCP Server. Your agent needs database credentials to run queries, so you hardcode them in the server configuration. Within hours, those credentials ar

For Security EngineersRead

n8n Sandbox Escape: CVE-2026-27577 Teardown

Incident

5 min read

n8n Sandbox Escape: CVE-2026-27577 Teardown

A contact form shouldn t give an attacker root access to your automation server. But in n8n versions prior to 2.10.1, that s exactly what could happen. Let s walk through how CVE-2026-27577 and CVE-20

For Security EngineersRead

Incident

4 min read

300,000 Ollama Servers Leaked Memory

On March 17, 2025, security researchers at Cyera disclosed CVE-2026-7482 , a critical vulnerability in Ollama that allowed attackers to extract arbitrary memory contents from running AI models. The fl

For Security EngineersRead

Incident

4 min read

Stolen Token to AWS Admin in 72 Hours

What Happened In August 2025, threat actor UNC6426 compromised the nx npm package, gaining full AWS administrator access within 72 hours. The attack began with a vulnerable pull_request_target workflo

For Security EngineersRead

MetInfo CMS Patch Ignored for 24 Days, Then Exploited

Incident

4 min read

MetInfo CMS Patch Ignored for 24 Days, Then Exploited

On May 1, 2026, attackers began exploiting CVE-2026-29014 , a PHP code injection vulnerability in MetInfo CMS with a CVSS score of 9.8. This flaw allows unauthenticated remote code execution, giving a

For Security EngineersRead

Mozilla Ships 271 AI-Found Bugs in One Release

Incident

3 min read

Mozilla Ships 271 AI-Found Bugs in One Release

What Happened In the Firefox 150 release, Mozilla disclosed 271 vulnerabilities discovered by Anthropic s Mythos AI model. This was a controlled discovery process, not a breach, revealing flaws in cod

For Security EngineersRead

Incident

3 min read

AI Pentests Show 32% High-Risk Findings

The Security Gap in AI Systems Cobalt s State of Pentesting Report highlights a significant gap between AI system security and traditional application security. When pentesters examined AI and LLM imp

For Security EngineersRead

Apache HTTP/2 Double-Free: When Default Settings Become Attack Surface

Incident

4 min read

Apache HTTP/2 Double-Free: When Default Settings Become Attack Surface

What Happened Apache HTTP Server version 2.4.66 contained a double-free vulnerability in its HTTP/2 protocol handling code (CVE-2026-23918). Discovered by Bartlomiej Dmitruk and colleagues, this flaw

For Security EngineersRead

454,600 Malicious Packages: The Axios Dependency Attack

Incident

4 min read

454,600 Malicious Packages: The Axios Dependency Attack

What Happened In 2025, attackers compromised the axios JavaScript package—one of the most widely used HTTP client libraries in the Node.js ecosystem—through a malicious transitive dependency. The atta

For Security EngineersRead

Apache HTTP/2 Double-Free: A Patch Deployment Failure

Incident

4 min read

Apache HTTP/2 Double-Free: A Patch Deployment Failure

What Happened A double-free vulnerability in Apache HTTP Server 2.4.66 (CVE-2026-23918, CVSS 8.8) allowed remote attackers to crash servers and potentially execute arbitrary code. The flaw existed in

For Security EngineersRead

Showing 209-224 of 344 articles

PreviousPage 14 of 22Next