Expert perspectives on application security, compliance, and emerging threats
IncidentSummary of Findings Cisco researchers tested AI models from OpenAI, Google, Amazon, and Anthropic against two attack patterns: single-prompt jailbreaks and multi-turn conversation attacks. The testing
IncidentWhat Happened Token Security researchers exploited a free Zapier account to gain write access to critical SDK packages on NPM. The attack didn t require zero-day vulnerabilities—just five known anti-p
IncidentWhat Happened A zero-day remote code execution (RCE) vulnerability in Gogs allows authenticated users to execute arbitrary commands on servers running versions 0.14.2 and 0.15.0+dev. Security research
IncidentIn a single day, attackers pushed 5,718 malicious commits across 5,561 public GitHub repositories in roughly six hours. SafeDep, the security firm that discovered the campaign, named it Megalodon. Thi
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Between July 2025 and February 2026, attackers exploited a deserialization vulnerability in KnowledgeDeliver LMS to install the Godzilla web shell on customer systems. The vulnerability,
IncidentOverview of the Vulnerability A source-code audit by X41 D-Sec revealed CVE-2026-48710, an authentication bypass vulnerability in Starlette , the ASGI framework used by FastAPI. This flaw allows attac
IncidentWhat Happened Since October 2025, the Glassworm botnet has been targeting developers through software supply-chain attacks. Unlike traditional botnets that rely on centralized command-and-control (C2)
IncidentIntroduction Anthropic has released a security-guidance plugin for Claude Code that runs vulnerability checks during active development. This tool is transforming how teams manage vulnerabilities by i
IncidentWhat Happened GlassWorm infected developer workstations through malicious packages and browser extensions, using stolen credentials to poison over 300 GitHub repositories. The malware compromised deve
GeneralScope This guide outlines immediate measures to secure GitHub repositories following the Megalodon campaign, which compromised over 5,500 repositories in six hours. You ll find detection workflows, cr
IncidentA developer installed what seemed to be a legitimate Solidity language extension for Cursor IDE. Within hours, their cryptocurrency wallet was drained of $500,000. The malware spread through the Open
IncidentWhat Happened In early 2025, two critical vulnerabilities in NGINX emerged within weeks of each other, both with CVSS v3x scores of 8.1. CVE-2026-42945, known as NGINX Rift, allows remote code executi
IncidentA critical authentication bypass in Gitea s container registry exposed private images to unauthorized users across more than 30,000 deployments worldwide. No credentials were needed, leaving what team
IncidentOn May 20, 2026, Drupal disclosed CVE-2026-9082 , a critical SQL injection vulnerability with a CVSS score of 9.8. Two days later, CISA added it to the Known Exploited Vulnerabilities catalog. This vu
IncidentWhat Happened On August 21, 2024, an attacker merged a pull request that altered the GitHub Actions workflow for the Nx monorepo toolchain, compromising the CI/CD pipeline. This led to the publication
ResearchSocket s research into the TrapDoor campaign reveals a critical issue your security team may have overlooked: developer workstations are now high-value targets. These workstations often run unmonitore
