Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened SentinelLabs identified malware targeting MacOS systems that contains instructions designed to make LLM-assisted security products abort their analysis. The malware, detected under the r
IncidentWhat Happened On June 25, 2026, researchers identified a supply chain breach affecting the Leo Platform ecosystem on npm. Sonatype found 23 malicious package versions linked to the Shai-Hulud Miasma c
IncidentA supply chain attack targeting npm packages and GitHub Actions workflows revealed how attackers can now move across package ecosystems to harvest developer credentials at scale. The Miasma malware ca
IncidentIn January 2025, Polymarket users experienced a significant security breach when $3 million in cryptocurrency vanished from their wallets. The culprit? Malicious JavaScript injected through a third-pa
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened In August 2019, an attacker compromised a maintainer s RubyGems account for the rest-client library and inserted malicious code into versions 1.6.11 through 1.6.13. This backdoor allowed
ResearchYou re building AI-powered research tools. Your agents pull from Reddit, Stack Overflow, and community forums because that s where real-world knowledge lives. But here s what Cornell Tech just proved:
IncidentWhat Happened Your .NET development team might spend weeks triaging vulnerability alerts from your software composition analysis (SCA) tool. Imagine your application pulls in 4,200 NuGet packages acro
IncidentWhat Happened Security researchers have found that modern LLMs rely heavily on role tags—such as system prompts and user designations—as their primary security framework. However, these tags do not pe
GeneralScope - What This Guide Covers This guide provides the security controls and response protocols your team needs when deploying large language models (LLMs) in production environments. The rapid jailbr
IncidentIn June 2019, Snyk discovered SQL injection vulnerabilities in Sequelize, a widely-used ORM library in the Node.js ecosystem. These flaws affected versions below 5.8.11 for MySQL and MariaDB, and vers
ResearchYou re overwhelmed by dependency vulnerabilities. Your SBOM lists 847 transitive dependencies. A new paper claims 94% accuracy in detecting malicious packages, but you can t use it. The gap between ac
IncidentWhat Happened In November 2023, Spring Boot 2.7 reached end-of-life. If your organization is still using this version, you re dealing with 143 known CVEs across 79 projects in your dependency tree. Th
GeneralScope This guide addresses browser extension security controls for enterprise environments. It covers permission analysis, remote code execution risks, and organizational policy frameworks for extensi
IncidentWhat Happened On April 15, 2026, NIST announced that the National Vulnerability Database (NVD) would stop providing comprehensive enrichment for most Common Vulnerabilities and Exposures (CVEs). Inste
IncidentOverview of the Issue In August 2019, W3Techs scanned websites and found jQuery running on 73% of them. Snyk s security research revealed that 83.4% of those jQuery installations used the 1.x release
IncidentIn early 2026, the timeline between discovering a vulnerability and its exploitation shrank dramatically—from days or weeks to mere hours. Security teams accustomed to a predictable patching schedule
