Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams759 Security Engineers759 Compliance Teams223 DevOps Leaders63 Developers31 CISOs17 IT Directors2

Topics:All759 Incident707 General188 Standards88 Research61 Guides34 Deadlines11 Vendor News4 Legal2

759 articles in Security Engineers · Clear filtersSort byNewest·Trending

Apache Tika's CVSS 10.0 XXE Flaw

Apache Tika's CVSS 10.0 XXE Flaw

Your application code passes every security review. Your internal XML parsing follows OWASP ASVS v4.0.3 guidance. But when Apache Tika 2.9.2 shipped with CVE-2025-66516—a CVSS 10.0 Critical XXE vulner

For Security EngineersRead article

Eight Packagist Packages Delivered Linux Malware Through package.json

Eight Packagist Packages Delivered Linux Malware Through package.json

What Happened Eight packages on Packagist , the primary PHP package repository, contained malicious code that downloaded and executed a Linux binary from GitHub. The attack bypassed PHP files by inser

For Security EngineersRead

Microsoft Drops Two Safety Tools for AI Agents

Microsoft Drops Two Safety Tools for AI Agents

Microsoft has released Rampart and Clarity as open-source projects, offering new ways for organizations to enhance AI agent security. These tools address a critical issue: AI agents now execute code,

For Security EngineersRead

ASAPP's Red Team Finds 50+ Flaws Daily

ASAPP's Red Team Finds 50+ Flaws Daily

Introduction: The Need for Continuous Adversarial Testing ASAPP, an enterprise AI provider, identified a significant gap in their security strategy: traditional pre-deployment testing couldn t keep up

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Shai-Hulud npm Attack: What Broke and What to Fix

Shai-Hulud npm Attack: What Broke and What to Fix

Incident Overview In the Shai-Hulud incident, attackers published malicious npm packages containing hidden exfiltration scripts. These packages bypassed initial security checks and infiltrated product

For Security EngineersRead

15,000 Exploit Attempts in Days: The Drupal SQL Injection Timeline

15,000 Exploit Attempts in Days: The Drupal SQL Injection Timeline

What Happened CVE-2026-9082 , a SQL injection vulnerability in Drupal Core with a CVSS score of 6.5, moved from patch release to active exploitation faster than most security teams could deploy fixes.

For Security EngineersRead

5,561 Repos Compromised in Six Hours

5,561 Repos Compromised in Six Hours

An attacker pushed 5,718 malicious commits across 5,561 GitHub repositories in just six hours. This campaign, known as Megalodon, didn t rely on a zero-day or novel vulnerability. Instead, it exploite

For Security EngineersRead

You Just Deleted a Compromised API Key. Now What?

You Just Deleted a Compromised API Key. Now What?

You found a Google API key in a public GitHub repo. You deleted it immediately. Your work is done, right? Not for the next 23 minutes. Aikido Security s research confirms that deleted Google API keys

For Security EngineersRead

WordPress Plugin Backdoor: 300 Zero-Days in 72 Hours

WordPress Plugin Backdoor: 300 Zero-Days in 72 Hours

What Happened Between late 2024 and early 2025, TrendAI and CHT Security used an AI-driven static analysis system to scan WordPress plugins. This system uncovered over 300 critical zero-day vulnerabil

For Security EngineersRead

Two Major Breaches, One Supply Chain Failure

Two Major Breaches, One Supply Chain Failure

On January 15, 2025, GitHub disclosed that attackers accessed internal repositories and exfiltrated source code. Days later, Grafana Labs confirmed a similar breach. Both incidents traced back to a su

For Security EngineersRead

Open-Source AI Security Tools Won't Fix Your Problems

Open-Source AI Security Tools Won't Fix Your Problems

The Conventional Wisdom Security teams are excited about Microsoft s release of Clarity and RAMPART, viewing them as transformative for AI security. The idea is straightforward: integrate these open-s

For Security EngineersRead

Two KEV Additions, One Lesson: Patch Before Threat Actors Do

Two KEV Additions, One Lesson: Patch Before Threat Actors Do

What Happened Between May 15 and May 21, 2025, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. CVE-2025-34291, an origin valid

For Security EngineersRead

Treasury Breach: A 15-Year-Old Flaw

Treasury Breach: A 15-Year-Old Flaw

What Happened In December 2024, state-sponsored attackers exploited a PostgreSQL SQL injection zero-day to infiltrate the US Treasury. This vulnerability allowed them to bypass authentication controls

For Security EngineersRead

ChromaDB CVE-2026-45829: Race Condition to RCE

ChromaDB CVE-2026-45829: Race Condition to RCE

Overview of the Vulnerability ChromaDB versions 1.0.0 through 1.5.8 have a critical vulnerability allowing unauthenticated remote code execution. The flaw, tracked as CVE-2026-45829, exploits a race c

For Security EngineersRead

1,467 Malicious AI Skills Found in ClawHub

1,467 Malicious AI Skills Found in ClawHub

An AI agent you deploy to automate customer support queries suddenly starts leaking API keys to an external server. Your incident response team traces it back to a helpful skill you installed three we

For Security EngineersRead

Google's 72 Open-Source Fixes: What CodeMender's Integration Reveals About AI Security Governance

Google's 72 Open-Source Fixes: What CodeMender's Integration Reveals About AI Security Governance

Introduction Google s integration of CodeMender, an AI-powered vulnerability remediation agent, into the Gemini Enterprise Agent Platform marks a strategic shift in AI security governance. This move d

For Security EngineersRead

Showing 465-480 of 759 articles

PreviousPage 30 of 48Next