Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened Attackers compromised the GitHub Actions workflow actions-cool/issues-helper by redirecting every existing tag in the repository to point to malicious commits. These imposter commits con
IncidentWhat Happened On May 19, 2026, an attacker compromised an AntV maintainer account and published over 300 malicious package versions across 323 packages in a 22-minute automated burst. The threat actor
IncidentOn January 15, 2025, attackers compromised maintainer accounts in the Ant Design (AntV) ecosystem and published malicious versions of multiple npm packages. The campaign, tracked as sonatype-2026-0032
IncidentOn May 20, 2026, between 5-9 p.m. UTC, the Drupal Security Team will release core security patches for branches 11.3.x, 11.2.x, 10.6.x, and 10.5.x. The advance notice is unusual. The prepare now langu
Get weekly security insights and compliance updates delivered to your inbox.
IncidentRecently, an attacker published 639 malicious versions across 323 unique npm packages in just 60 minutes. This campaign, known as Shai-Hulud, primarily targeted the @antv data visualization ecosystem.
IncidentWhat Happened Researchers discovered multiple vulnerabilities in OpenClaw , an AI agent framework, that allowed attackers to steal credentials, escalate privileges, and maintain persistence within aff
IncidentBetween late 2024 and early 2025, four malicious npm packages delivered the Shai-Hulud infostealer to developer machines. These packages—typosquats of legitimate tools—were downloaded 2,678 times befo
IncidentBetween late 2024 and early 2025, four malicious packages appeared on the npm registry and accumulated 3,006 downloads before removal. One package, chalk-tempalte (note the misspelling), contained a d
IncidentWhat Happened CVE-2026-42897 , a cross-site scripting (XSS) vulnerability in Microsoft Exchange s Outlook Web Access (OWA), is being actively exploited with no patch available. Attackers can compromis
IncidentOn February 19, 2025, Microsoft and the Institute of Science Tokyo published research documenting a new class of AI model backdoor that bypasses every content-based security control you re running. Th
IncidentBetween January 14 and January 24, 2026, five enterprise software vendors released patches for critical vulnerabilities with CVSS scores ranging from 9.1 to 9.6. If your team manages any combination o
IncidentWhat Happened Between late 2024 and early 2025, three separate credential-harvesting campaigns targeted npm , PyPI, and Docker Hub within a 48-hour period. These attacks followed a common pattern: com
IncidentA research team at Xidian University has demonstrated a new type of attack that manipulates multimodal AI systems through altered images. This attack, called CrossMPI, achieved a 66.36% average succes
IncidentWhat Happened Attackers are actively exploiting CVE-2026-42945 , a heap buffer overflow in NGINX s ngx_http_rewrite_module . VulnCheck detected exploitation attempts against their honeypot networks. T
IncidentWhat Happened The DARPA Artificial Intelligence Cyber Challenge (AIxCC) concluded with a $30,500,000 prize pool, showcasing AI s potential in vulnerability detection. Seven teams deployed AI systems a
IncidentSecureLayer7 released Sandyaa in late 2024 under an MIT license. This tool uses large language models to scan source code for vulnerabilities and then writes exploit code to prove they re real. Within
