Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams737 Security Engineers1021 Compliance Teams274 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All737 Incident912 General269 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

737 articles in Security Engineers · Incident · Clear filtersSort byNewest·Trending

120,000 Downloads: When an IDE Extension Became RCE

Incident

Latest

3 min read

120,000 Downloads: When an IDE Extension Became RCE

The Threat of IDE Extensions Snyk s security research team discovered remote code execution vulnerabilities in Visual Studio Code extensions available through the official marketplace. A significant e

For Security EngineersRead article

LLM-Powered Pipeline Monitor Flags Credential Theft

Incident

5 min read

LLM-Powered Pipeline Monitor Flags Credential Theft

What Happened Elastic Security Labs has introduced the CI/CD Abuse Detector, an open-source prototype that employs a large language model (LLM) to scan pipeline changes for suspicious activity before

For Security EngineersRead

SuiteCRM Deserialization Bug: When Patching Leaves the Door Open

Incident

5 min read

SuiteCRM Deserialization Bug: When Patching Leaves the Door Open

What Happened An authenticated administrator in SuiteCRM could execute arbitrary OS commands through a PHAR deserialization vulnerability. The attack involved uploading a specially crafted PHAR file t

For Security EngineersRead

Log4Shell: 60% of Java Projects Failed Before the Breach

Incident

4 min read

Log4Shell: 60% of Java Projects Failed Before the Breach

What Happened On December 9, 2021, security researchers disclosed CVE-2021-44228 , a remote code execution vulnerability in Apache Log4j 2. Known as Log4Shell, it received a CVSS score of 10, indicati

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Log4Shell: How a Logging Library Became a 10.0 CVSS Nightmare

Incident

4 min read

Log4Shell: How a Logging Library Became a 10.0 CVSS Nightmare

What Happened On December 10, 2021, a critical remote code execution vulnerability in Apache Log4j, identified as CVE-2021-44228, received a CVSS score of 10—the highest severity rating. Known as Log4

For Security EngineersRead

CVE-2021-44832: A Disclosure Failure Teardown

Incident

4 min read

CVE-2021-44832: A Disclosure Failure Teardown

On December 28, 2021, the Apache Log4j team released version 2.17.1 to patch CVE-2021-44832, a remote code execution vulnerability with a CVSS score of 6.6. The technical details are less critical tha

For Security EngineersRead

Log4Shell: The Dependency You Didn't Know You Had

Incident

3 min read

Log4Shell: The Dependency You Didn't Know You Had

What Happened On December 10, 2021, the Apache Log4j team disclosed CVE-2021-44832 , a remote code execution vulnerability in a widely used Java logging library. Attackers could exploit this by sendin

For Security EngineersRead

Incident

4 min read

Log4j 2.16 DoS: When a Patch Becomes an Incident

What Happened On December 18, 2021, Apache disclosed CVE-2021-45105 , a high-severity Denial of Service vulnerability in Log4j version 2.16 — the version released just days earlier to fix CVE-2021-450

For Security EngineersRead

Incident

4 min read

Log4j 2.15 Fell in 72 Hours

What Happened On December 14, 2021, Apache released Log4j version 2.15.0 to address CVE-2021-44228 , the Log4Shell vulnerability. Security teams worldwide rushed to deploy the patch. However, three da

For Security EngineersRead

AI Agent Runs Malicious Code from Error Logs

Incident

5 min read

AI Agent Runs Malicious Code from Error Logs

What Happened Tenet Security discovered a new attack pattern called Agentjacking that weaponizes AI coding agents against their own development teams. The attack works by injecting malicious code into

For Security EngineersRead

When the AI Agent You Built Stops Working

Incident

4 min read

When the AI Agent You Built Stops Working

You developed an AI security agent in just three days. It scanned your repositories, flagged secrets, and impressed your VP. Two months later, it s generating 400 false positives per day, and your tea

For Security EngineersRead

phpBB's Ten-Year Auth Bypass: A Teardown

Incident

4 min read

phpBB's Ten-Year Auth Bypass: A Teardown

An authentication bypass vulnerability lingered in phpBB s codebase for a decade, allowing admin access through a specially crafted request. Aikido discovered the flaw on June 2nd, and phpBB released

For Security EngineersRead

Log4Shell: When a Logging Library Became an RCE Vector

Incident

5 min read

Log4Shell: When a Logging Library Became an RCE Vector

What Happened On December 9, 2021, security researchers disclosed CVE-2021-44228 , a critical remote code execution vulnerability in Log4j2, a widely used Java logging framework maintained by the Apac

For Security EngineersRead

3,000 Stolen GitHub Tokens Found on Dark Forums

Incident

4 min read

3,000 Stolen GitHub Tokens Found on Dark Forums

What Happened Flare researchers discovered active listings for compromised developer credentials and access tokens on underground forums—weeks before these same credentials appeared in public supply-c

For Security EngineersRead

Incident

5 min read

AI Agent Hijacked on Live Demo Platform

What Happened A security evaluation using the StakeBench benchmark revealed that current AI web agents are vulnerable to prompt injection attacks across various deployment scenarios. Researchers teste

For Security EngineersRead

400 AUR Packages Hijacked Through Maintainer Abandonment

Incident

5 min read

400 AUR Packages Hijacked Through Maintainer Abandonment

What Happened On or after June 11, an attacker compromised over 400 packages in the Arch User Repository (AUR) by exploiting a fundamental weakness in community-maintained package systems: abandonment

For Security EngineersRead

Showing 401-416 of 737 articles

PreviousPage 26 of 47Next