Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened On June 5, ServiceNow issued security update KB3067321 for hosted customers after discovering an API endpoint that allowed unauthenticated access to customer data. The vulnerable endpoin
IncidentOverview of the Vulnerability On February 13, 2022, Adobe disclosed CVE-2022-24086 , a critical arbitrary code execution vulnerability in the Magento template engine. This flaw affected Magento Open S
IncidentWhat Happened Between late 2024 and early 2025, attackers published malicious Node.js packages to npm that used invisible Unicode characters and package manager configuration files to execute hidden c
IncidentOverview of the Vulnerability A vulnerability in the Linux kernel pipe implementation, known as CVE-2022-0847 , allowed any process to overwrite data in arbitrary read-only files. Dubbed Dirty Pipe, t
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Adobe released a security patch for Magento in February 2022 to address CVE-2022-24086 , a critical vulnerability allowing SQL injection or PHP object injection during checkout for unaut
IncidentWhat Happened Your security team ran quarterly automated penetration tests on your production environment. The reports showed stable results: no critical findings and a few medium-severity issues alre
GeneralSecurity vendors and AI labs are promoting large language models as the future of automated vulnerability detection. The excitement peaked when XBOW evaluated Anthropic s Mythos Preview model, noting
IncidentWhat Happened The Miasma worm s source code was deliberately distributed on GitHub through compromised developer accounts. Unlike accidental exposures or proof-of-concept leaks, this was a targeted at
IncidentOn May 11, 2026, attackers published 84 malicious npm packages across 42 @tanstack repositories. Each package carried cryptographically valid SLSA Build Level 3 attestations. If your team relies on SL
IncidentWhat Happened Microsoft removed 73 GitHub repositories after malware compromised developer credentials and exposed a PyPI publishing token. The attack targeted the durabletask PyPI token, allowing an
IncidentA path traversal vulnerability in Langflow—an open-source AI development platform with more than 149,000 GitHub stars—is being actively exploited. CVE-2026-5027 allows attackers to write arbitrary fil
IncidentCyera s security researchers disclosed six vulnerabilities in protobuf.js that turned schema validation—a process most teams assume is safe—into a remote code execution (RCE) pathway. The vulnerabilit
IncidentWhat Happened An unauthenticated remote code execution vulnerability (CVE-2026-5027) in Langflow, an open-source platform for building AI applications, remains unpatched despite active exploitation. T
IncidentOverview of the Vulnerability A critical remote code execution vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento 2 and Adobe Commerce allowed attackers to execute arbitrary co
IncidentWhat Happened StepSecurity researchers uncovered a malware campaign targeting Python development environments and AI-powered security tools. The malware, named Hades, compromised the C++ library ensma
IncidentWhat Happened BerriAI s LiteLLM, a proxy layer for managing multiple LLM providers, contained a command injection vulnerability ( CVE-2026-42271 ) that allowed authenticated users to execute arbitrary
