Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams753 Security Engineers759 Compliance Teams223 DevOps Leaders63 Developers31 CISOs17 IT Directors2

Topics:All753 Incident707 General188 Standards88 Research61 Guides34 Deadlines11 Vendor News4 Legal2

753 articles in Security Engineers · Clear filtersSort byNewest·Trending

Remote Script Injection in 10M+ Install Extension

Remote Script Injection in 10M+ Install Extension

Scope This guide addresses browser extension security controls for enterprise environments. It covers permission analysis, remote code execution risks, and organizational policy frameworks for extensi

For Security EngineersRead article

NVD Stops Enriching Most CVEs: Teardown

NVD Stops Enriching Most CVEs: Teardown

What Happened On April 15, 2026, NIST announced that the National Vulnerability Database (NVD) would stop providing comprehensive enrichment for most Common Vulnerabilities and Exposures (CVEs). Inste

For Security EngineersRead

84% of Sites Still Running Vulnerable jQuery

84% of Sites Still Running Vulnerable jQuery

Overview of the Issue In August 2019, W3Techs scanned websites and found jQuery running on 73% of them. Snyk s security research revealed that 83.4% of those jQuery installations used the 1.x release

For Security EngineersRead

Agentic AI Broke the Timeline: A 2026 Attack Teardown

Agentic AI Broke the Timeline: A 2026 Attack Teardown

In early 2026, the timeline between discovering a vulnerability and its exploitation shrank dramatically—from days or weeks to mere hours. Security teams accustomed to a predictable patching schedule

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Malicious AI Skill Reached 26,000 Users After Passing Static Scans

Malicious AI Skill Reached 26,000 Users After Passing Static Scans

What Happened AIR , a security research organization, deployed a fake AI agent skill marketed as a landing page builder tool. The skill passed security validation from Cisco, Nvidia, and skills.sh sca

For Security EngineersRead

Malicious PostCSS Packages on npm: A Supply Chain Attack Teardown

Malicious PostCSS Packages on npm: A Supply Chain Attack Teardown

What Happened A user named abdrizak published three malicious npm packages disguised as legitimate PostCSS tools: aes-decode-runner-pro , postcss-minify-selector , and postcss-minify-selector-parser .

For Security EngineersRead

LiteLLM RCE Exploit: When Two CVEs Become One Kill Chain

LiteLLM RCE Exploit: When Two CVEs Become One Kill Chain

What Happened Between late 2025 and early 2026, attackers discovered they could chain two vulnerabilities in LiteLLM—an open-source AI gateway used to route requests across multiple LLM providers—to a

For Security EngineersRead

Stop Verifying AI Code Like It's Human Code

Stop Verifying AI Code Like It's Human Code

The conventional wisdom suggests that AI-generated code should undergo the same review process as human-written code. This involves running it through your existing CI/CD pipeline, having a senior dev

For Security EngineersRead

170 npm Packages Compromised via GitHub Actions

170 npm Packages Compromised via GitHub Actions

What Happened On June 18, 2024, GitHub announced a security update to actions/checkout v7 to prevent workflows from executing unreviewed code from forked pull requests. This change addresses a recent

For Security EngineersRead

Code Execution via Webpage in AutoGen Studio

Code Execution via Webpage in AutoGen Studio

A vulnerability chain in Microsoft s AutoGen Studio allowed attackers to execute arbitrary code through malicious webpages. This flaw affected developers who built the framework from GitHub source dur

For Security EngineersRead

AI Agent Skills Passed Every Security Scan—Then Turned Malicious

AI Agent Skills Passed Every Security Scan—Then Turned Malicious

Security scanners gave it a clean bill of health. GitHub stars suggested community trust. The skill looked legitimate by every conventional measure. Then it changed—after installation—and roughly 26,0

For Security EngineersRead

GitHub Blocks Pwn Requests in CI/CD Workflows

GitHub Blocks Pwn Requests in CI/CD Workflows

On June 18, 2026, GitHub updated actions/checkout to prevent fetching fork pull request code when triggered by pull_request_target or workflow_run events. This change addresses an attack pattern where

For Security EngineersRead

Vetting AI Plugin Sources: Your Decision Tree

Vetting AI Plugin Sources: Your Decision Tree

Your team wants to integrate AI agents into your development workflow. You find a plugin registry with hundreds of options. Some have official-looking scope names. Some claim to be maintained by the r

For Security EngineersRead

Strict HTTP Parsing Broke Your API: The Node.js CVE-2019-15606 Incident

Strict HTTP Parsing Broke Your API: The Node.js CVE-2019-15606 Incident

What Happened On February 6, 2020, the Node.js project released emergency patches for versions 10.x, 12.x, and 13.x to address one critical and two high-severity vulnerabilities. The critical flaw, tr

For Security EngineersRead

Agentjacking: Code Execution via Poisoned Error Logs

Agentjacking: Code Execution via Poisoned Error Logs

A developer at a Fortune 100 technology company opened their AI coding assistant one morning. Within minutes, an attacker was executing code on their machine—no credential theft, no malware download,

For Security EngineersRead

Ghostcat: When a Default Port Became a Data Breach Vector

Ghostcat: When a Default Port Became a Data Breach Vector

What Happened On February 20, 2020, CNVD published details of CVE-2020-1938—a vulnerability affecting Apache Tomcat versions 6 through 9. Discovered by Chaitin Tech on January 3rd, the flaw exploited

For Security EngineersRead

Showing 241-256 of 753 articles

PreviousPage 16 of 48Next