Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened A malicious npm package named codexui-android infiltrated the supply chain of OpenAI Codex users, exfiltrating authentication tokens to an attacker-controlled server at sentry.anyclaw[.]
IncidentWhat Happened On September 7, 2017, Equifax disclosed a breach that exposed personal information of 147 million people. The attack exploited CVE-2017-5638 , a remote code execution vulnerability in Ap
IncidentWhat Happened CVE-2022-1471 exposed a critical flaw in SnakeYaml s Constructor class, allowing arbitrary code execution through unsafe deserialization. This vulnerability affects the org.yaml:snakeyam
IncidentWhat Happened Security researcher Zemnmez discovered a use-of-weak-hash vulnerability in crypto-js and crypto-es, two widely-used JavaScript cryptography libraries. The vulnerability (CVE-2023-46233 f
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened On October 11, 2023, the curl project disclosed CVE-2023-38545 , a heap-based buffer overflow in libcurl versions 7.69.0 through 8.3.0. The vulnerability affects the SOCKS5 proxy handsha
IncidentThe Problem Snyk s 2023 State of Open Source Security report highlights a critical issue: 40% of organizations do not use Software Composition Analysis (SCA) or Static Application Security Testing (SA
IncidentWhat Happened On September 11, 2023, CVE-2023-4863 was disclosed with a CVSS score of 9.6. The vulnerability affects libwebp, an image codec library, across versions 0.5.0 through 1.3.1. An attacker c
IncidentOn December 7, 2023, the Apache Software Foundation disclosed CVE-2023-50164 , a path traversal vulnerability in Apache Struts with a CVSS score of 9.8. This flaw allows attackers to manipulate file u
IncidentOverview of the Vulnerability A critical vulnerability in WP Maps Pro allowed attackers to create administrator accounts on WordPress sites without authentication. The flaw, tracked as CVE-2026-8732,
IncidentWhat Happened A security researcher demonstrated that npm s default configuration allows malicious packages to exfiltrate macOS keyboard shortcuts through Node.js scripts executed during package insta
IncidentWhat Happened CVE-2024-22195 exposed a cross-site scripting vulnerability in Jinja2, the Python templating library with over 33 million weekly downloads. The flaw existed in all versions prior to 3.1.
IncidentWhat Happened A Chinese company named Funnull acquired the polyfill.io domain and CDN service in February 2024. Soon after, the new owners injected malicious code into the JavaScript files served from
IncidentWhat Happened FastAPI applications using the python-multipart package were exposed to regular expression denial of service (ReDoS) attacks through CVE-2024-24762. This vulnerability arose from an inse
IncidentYour CI/CD pipeline just pulled a malicious package. The commit shows an AI coding agent added it. The security alert lands on your desk. Who do you hold accountable? AI coding agents are autonomously
IncidentWhat Happened Recently, attackers compromised the npm package @lottiefiles/lottie-player , injecting malicious code to steal cryptocurrency wallet credentials. They released three tainted versions—2.0
IncidentWhat Happened A typo-squatting attack on the BoltDB Go module was active from November 2021 until January 30, 2025. The malicious package—version 1.3.1 of a forked repository—contained a backdoor that
