Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1021 Security Engineers1021 Compliance Teams275 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All1021 Incident912 General270 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

1021 articles in Security Engineers · Clear filtersSort byNewest·Trending

Log4Shell: How a Logging Library Became a 10.0 CVSS Nightmare

Log4Shell: How a Logging Library Became a 10.0 CVSS Nightmare

What Happened On December 10, 2021, a critical remote code execution vulnerability in Apache Log4j, identified as CVE-2021-44228, received a CVSS score of 10—the highest severity rating. Known as Log4

For Security EngineersRead article

Jackson Deserialization Myths That Put Your Java Apps at Risk

Jackson Deserialization Myths That Put Your Java Apps at Risk

You ve added Jackson to your project, configured your ObjectMapper, and moved on. The library works, your tests pass, and JSON flows through your API without issue. But security engineers keep finding

For Security EngineersRead

CVE-2021-44832: A Disclosure Failure Teardown

CVE-2021-44832: A Disclosure Failure Teardown

On December 28, 2021, the Apache Log4j team released version 2.17.1 to patch CVE-2021-44832, a remote code execution vulnerability with a CVSS score of 6.6. The technical details are less critical tha

For Security EngineersRead

Log4Shell: The Dependency You Didn't Know You Had

Log4Shell: The Dependency You Didn't Know You Had

What Happened On December 10, 2021, the Apache Log4j team disclosed CVE-2021-44832 , a remote code execution vulnerability in a widely used Java logging library. Attackers could exploit this by sendin

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Log4j 2.16 DoS: When a Patch Becomes an Incident

Log4j 2.16 DoS: When a Patch Becomes an Incident

What Happened On December 18, 2021, Apache disclosed CVE-2021-45105 , a high-severity Denial of Service vulnerability in Log4j version 2.16 — the version released just days earlier to fix CVE-2021-450

For Security EngineersRead

Log4j 2.15 Fell in 72 Hours

Log4j 2.15 Fell in 72 Hours

What Happened On December 14, 2021, Apache released Log4j version 2.15.0 to address CVE-2021-44228 , the Log4Shell vulnerability. Security teams worldwide rushed to deploy the patch. However, three da

For Security EngineersRead

AI Code Models Trained on Swept Data Cut Vulnerabilities by 41%

AI Code Models Trained on Swept Data Cut Vulnerabilities by 41%

The focus on AI-assisted coding often centers on model architecture and performance metrics. However, new data from Sonar s SonarSweep experiments highlights a critical factor: the quality of training

For Security EngineersRead

Loop-Driven AI Development: A Verification Field Guide

Loop-Driven AI Development: A Verification Field Guide

In AI-driven development, verifying that your agents build correctly is as important as what they build. The shift from prompt-driven to loop-driven development fundamentally changes your verification

For Security EngineersRead

AI Agent Runs Malicious Code from Error Logs

AI Agent Runs Malicious Code from Error Logs

What Happened Tenet Security discovered a new attack pattern called Agentjacking that weaponizes AI coding agents against their own development teams. The attack works by injecting malicious code into

For Security EngineersRead

When the AI Agent You Built Stops Working

When the AI Agent You Built Stops Working

You developed an AI security agent in just three days. It scanned your repositories, flagged secrets, and impressed your VP. Two months later, it s generating 400 false positives per day, and your tea

For Security EngineersRead

phpBB's Ten-Year Auth Bypass: A Teardown

phpBB's Ten-Year Auth Bypass: A Teardown

An authentication bypass vulnerability lingered in phpBB s codebase for a decade, allowing admin access through a specially crafted request. Aikido discovered the flaw on June 2nd, and phpBB released

For Security EngineersRead

Log4Shell: When a Logging Library Became an RCE Vector

Log4Shell: When a Logging Library Became an RCE Vector

What Happened On December 9, 2021, security researchers disclosed CVE-2021-44228 , a critical remote code execution vulnerability in Log4j2, a widely used Java logging framework maintained by the Apac

For Security EngineersRead

3,000 Stolen GitHub Tokens Found on Dark Forums

3,000 Stolen GitHub Tokens Found on Dark Forums

What Happened Flare researchers discovered active listings for compromised developer credentials and access tokens on underground forums—weeks before these same credentials appeared in public supply-c

For Security EngineersRead

Your AI Debugger Is Fighting Yesterday's War

Your AI Debugger Is Fighting Yesterday's War

The Conventional Wisdom When your AI integration starts producing incorrect outputs, your team often relies on familiar tools: stack traces, breakpoints, and unit tests. You might add logging around t

For Security EngineersRead

AI Agent Hijacked on Live Demo Platform

AI Agent Hijacked on Live Demo Platform

What Happened A security evaluation using the StakeBench benchmark revealed that current AI web agents are vulnerable to prompt injection attacks across various deployment scenarios. Researchers teste

For Security EngineersRead

400 AUR Packages Hijacked Through Maintainer Abandonment

400 AUR Packages Hijacked Through Maintainer Abandonment

What Happened On or after June 11, an attacker compromised over 400 packages in the Arch User Repository (AUR) by exploiting a fundamental weakness in community-maintained package systems: abandonment

For Security EngineersRead

Showing 577-592 of 1021 articles

PreviousPage 37 of 64Next