Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams737 Security Engineers1021 Compliance Teams274 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All737 Incident912 General269 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

737 articles in Security Engineers · Incident · Clear filtersSort byNewest·Trending

Google's 72 Open-Source Fixes: What CodeMender's Integration Reveals About AI Security Governance

Incident

Latest

3 min read

Google's 72 Open-Source Fixes: What CodeMender's Integration Reveals About AI Security Governance

Introduction Google s integration of CodeMender, an AI-powered vulnerability remediation agent, into the Gemini Enterprise Agent Platform marks a strategic shift in AI security governance. This move d

For Security EngineersRead article

Next.js Middleware Bypass: CVE-2026-44575

Incident

4 min read

Next.js Middleware Bypass: CVE-2026-44575

What Happened CVE-2026-44575 allows attackers to bypass middleware-based authorization controls in Next.js App Router applications through manipulated request paths. The vulnerability affects Next.js

For Security EngineersRead

Incident

4 min read

3,800 Repos Stolen in 18 Minutes

On May 18, 2026, GitHub disclosed a breach of its internal repositories. The attack vector: a trojanized VS Code extension called Nx Console, maintained by Narwhal Technologies. The compromised versio

For Security EngineersRead

3,800 GitHub Repos Breached via VS Code Extension

Incident

4 min read

3,800 GitHub Repos Breached via VS Code Extension

What Happened Attackers compromised the Nx Console VS Code extension and published a malicious version to the Visual Studio Marketplace. This version exfiltrated authentication tokens from developers

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

PolinRider Used Blockchain to Hide Malware in npm Package

Incident

5 min read

PolinRider Used Blockchain to Hide Malware in npm Package

What Happened Between late 2024 and early 2025, attackers compromised two versions of the npm package @common-stack/generate-plugin (9.0.2-alpha.21 and 9.0.2-alpha.22). The package, which sees over 1,

For Security EngineersRead

Drupal CVE-2026-9082: When Anonymous Users Get RCE

Incident

3 min read

Drupal CVE-2026-9082: When Anonymous Users Get RCE

What Happened Drupal recently released emergency security updates for six supported versions to patch CVE-2026-9082 , a vulnerability that allows anonymous users to execute remote code on sites using

For Security EngineersRead

When Equifax Ignored Its Own DAST Findings

Incident

3 min read

When Equifax Ignored Its Own DAST Findings

Equifax s Security Oversight In 2017, Equifax suffered a massive data breach that exposed the personal information of 147 million people. The breach was due to an unpatched Apache Struts vulnerability

For Security EngineersRead

Drupal's CVE-2026-9082: SQL Injection Through the Dependency Stack

Incident

3 min read

Drupal's CVE-2026-9082: SQL Injection Through the Dependency Stack

Overview of the Vulnerability Drupal has released emergency patches for CVE-2026-9082, a critical SQL injection vulnerability affecting sites using PostgreSQL. This issue required coordinated patches

For Security EngineersRead

One Unrotated Token: Grafana's GitHub Breach

Incident

5 min read

One Unrotated Token: Grafana's GitHub Breach

What Happened On May 1, 2025, Grafana detected unauthorized access to its private GitHub repositories. The attacker exploited a single GitHub workflow token that should have been rotated weeks earlier

For Security EngineersRead

Grafana Breach: When npm Supply Chain Attack Met GitHub Tokens

Incident

5 min read

Grafana Breach: When npm Supply Chain Attack Met GitHub Tokens

What Happened On May 11, 2026, Grafana Labs detected unauthorized access to multiple GitHub repositories containing source code and internal information. The entry point was a compromised TanStack npm

For Security EngineersRead

3,000 Malicious Packages Logged in OSV: Where Your Pipeline Failed

Incident

4 min read

3,000 Malicious Packages Logged in OSV: Where Your Pipeline Failed

The Problem: Undetected Malicious Packages Your dependency scanner missed it. Your code review didn t catch it. A malicious package slipped through your CI/CD pipeline and into production because you

For Security EngineersRead

Drupal's May 20 Critical Patch: What Went Wrong

Incident

5 min read

Drupal's May 20 Critical Patch: What Went Wrong

On May 20, 2025, between 17:00 and 21:00 UTC, Drupal administrators worldwide scrambled to apply emergency security patches. The Drupal Security Team had issued a rare advance warning: a critical vuln

For Security EngineersRead

Nx Console 18.95.0: When a Trusted Extension Steals Your Credentials

Incident

3 min read

Nx Console 18.95.0: When a Trusted Extension Steals Your Credentials

What Happened Version 18.95.0 of the Nx Console extension for Visual Studio Code was published with malicious code designed to steal developer credentials. This compromised version contained a 498 KB

For Security EngineersRead

639 Malicious npm Packages: The @antv Compromise

Incident

5 min read

639 Malicious npm Packages: The @antv Compromise

On an ordinary Tuesday, a maintainer account for the @antv ecosystem—a collection of popular data visualization libraries—began publishing trojanized versions of packages your team might already be us

For Security EngineersRead

637 Malicious npm Packages in 22 Minutes

Incident

3 min read

637 Malicious npm Packages in 22 Minutes

Attack Overview On May 19, an attacker compromised a maintainer account for AntV, a widely-used data visualization library, and published 637 malicious versions across 317 npm packages in just 22 minu

For Security EngineersRead

ChromaDB CVE-2026-45829: When Your Vector Database Becomes a Remote Shell

Incident

4 min read

ChromaDB CVE-2026-45829: When Your Vector Database Becomes a Remote Shell

Overview of the Vulnerability On February 17, 2025, security researchers at HiddenLayer disclosed CVE-2026-45829 , a critical vulnerability in ChromaDB s Python FastAPI implementation. This flaw allow

For Security EngineersRead

Showing 545-560 of 737 articles

PreviousPage 35 of 47Next