Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams86 Security Engineers142 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All86 Incident142 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

86 articles in Security Engineers · Incident · Clear filtersSort byNewest·Trending

Malicious Preinstall Scripts Compromise SAP Development Packages

Incident

Latest

3 min read

Malicious Preinstall Scripts Compromise SAP Development Packages

Incident Overview On April 29, 2026, between 09:55 UTC and 12:14 UTC, attackers released compromised versions of several npm packages linked to SAP s JavaScript and cloud application development ecosy

For Security EngineersRead article

8 Hours to Steal Cloud Credentials: The elementary-data Supply Chain Attack

Incident

5 min read

8 Hours to Steal Cloud Credentials: The elementary-data Supply Chain Attack

What Happened On April 24, 2025, attackers published version 0.23.3 of the Python package elementary-data to PyPI. This malicious release contained code designed to exfiltrate cloud credentials from a

For Security EngineersRead

Self-Propagating Malware Hides in VS Code Extensions

Incident

4 min read

Self-Propagating Malware Hides in VS Code Extensions

What Happened Attackers distributed self-propagating malware through VS Code extensions published to the Open VSX repository. These extensions appeared legitimate but contained code designed to spread

For Security EngineersRead

LiteLLM SQLi Exploit: 36 Hours from Disclosure to Active Attack

Incident

3 min read

LiteLLM SQLi Exploit: 36 Hours from Disclosure to Active Attack

What Happened On April 24, security researchers disclosed CVE-2026-42208 , a critical SQL injection vulnerability in LiteLLM, an open-source gateway for managing LLM API calls. This flaw allowed attac

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

When a Fintech Vendor Gets Ransomware, 672,000 People Pay the Price

Incident

3 min read

When a Fintech Vendor Gets Ransomware, 672,000 People Pay the Price

What Happened Marquis, a fintech company serving financial institutions, suffered a ransomware attack that exposed personal information for at least 672,075 individuals. The attackers bypassed direct

For Security EngineersRead

A Single Git Push Could Have Compromised GitHub's Entire Backend

Incident

3 min read

A Single Git Push Could Have Compromised GitHub's Entire Backend

What Happened In late 2024, security researchers at Wiz discovered CVE-2026-3854, a remote code execution vulnerability in GitHub s infrastructure. This flaw allowed attackers to execute arbitrary cod

For Security EngineersRead

Cursor IDE Vulnerability: When AI Agents Execute Malicious Git Hooks

Incident

4 min read

Cursor IDE Vulnerability: When AI Agents Execute Malicious Git Hooks

Overview of the Vulnerability A critical vulnerability in Cursor IDE allowed attackers to execute arbitrary code through Git operations performed by the IDE s AI agent. This flaw, tracked as CVE-2026-

For Security EngineersRead

Unsafe Deserialization Takes Down Robotics Platform: The LeRobot CVE-2026-25874 Breakdown

Incident

4 min read

Unsafe Deserialization Takes Down Robotics Platform: The LeRobot CVE-2026-25874 Breakdown

A critical vulnerability in Hugging Face s LeRobot platform highlights the overlooked risks of using unsafe serialization formats in open-source projects. CVE-2026-25874, scoring 9.3 on CVSS, allows u

For Security EngineersRead

73 Malicious Extensions Sat Dormant in OpenVSX for Months

Incident

5 min read

73 Malicious Extensions Sat Dormant in OpenVSX for Months

What Happened Between late 2024 and early 2025, attackers planted 73 malicious extensions in the OpenVSX registry—an open-source alternative to the Visual Studio Code Marketplace. These extensions app

For Security EngineersRead

Microsoft's Agent ID Administrator Flaw: A Privilege Escalation Teardown

Incident

5 min read

Microsoft's Agent ID Administrator Flaw: A Privilege Escalation Teardown

What Happened Microsoft s Entra ID (formerly Azure AD) had a role misconfiguration that allowed the Agent ID Administrator role to escalate privileges beyond its intended scope. Designed to manage aut

For Security EngineersRead

Checkmarx GitHub Repository Breach: What Happened and How to Prevent It

Incident

3 min read

Checkmarx GitHub Repository Breach: What Happened and How to Prevent It

On March 23, 2026, Checkmarx—a company specializing in application security testing tools—experienced a supply chain attack on their GitHub repository. Data from this repository later surfaced on the

For Security EngineersRead

Cryptominers Exploited Two Auth Bypass Flaws in Qinglong's Middleware

Incident

4 min read

Cryptominers Exploited Two Auth Bypass Flaws in Qinglong's Middleware

Incident Overview On February 27, 2026, researchers disclosed two authentication bypass vulnerabilities in Qinglong, an open-source task scheduler with over 19,000 GitHub stars. CVE-2026-3965 and CVE-

For Security EngineersRead

20 Hours: The Langflow RCE Exploit Timeline

Incident

4 min read

20 Hours: The Langflow RCE Exploit Timeline

What Happened A critical remote code execution vulnerability in Langflow—an open-source tool for building AI pipelines—was exploited in the wild within 20 hours of public disclosure. The vulnerability

For Security EngineersRead

Two OpenAI Vulnerabilities Expose the Input Validation Gap in AI Tools

Incident

5 min read

Two OpenAI Vulnerabilities Expose the Input Validation Gap in AI Tools

What Happened OpenAI recently patched two vulnerabilities in its AI products that could have enabled unauthorized data movement. The first, discovered by BeyondTrust researchers, affected Codex: a com

For Security EngineersRead

The Trivy Compromise: 75 Version Tags Poisoned in 24 Hours

Incident

4 min read

The Trivy Compromise: 75 Version Tags Poisoned in 24 Hours

What Happened Attackers compromised the Aqua Security repository hosting Trivy , a widely used vulnerability scanner, poisoning 75 of 76 version tags. This turned a tool meant to find vulnerabilities

For Security EngineersRead

513,000 Lines of AI Code Leaked Through a Source Map

Incident

4 min read

513,000 Lines of AI Code Leaked Through a Source Map

What Happened Security researcher Chaofan Shou recently discovered that Anthropic accidentally exposed the complete source code for Claude Code—their AI coding agent—through a public npm package. The

For Security EngineersRead

Showing 17-32 of 86 articles

PreviousPage 2 of 6Next