Expert perspectives on application security, compliance, and emerging threats
IncidentA critical authentication bypass in the Burst Statistics WordPress plugin gave attackers admin-level access to thousands of websites. Here s what happened, which controls failed, and what your team ne
IncidentWhat Happened Between early December 2024 and January 16, 2025, attackers exploited a critical vulnerability in FunnelKit s Funnel Builder plugin to inject malicious JavaScript into WooCommerce checko
IncidentDiscovery of a Long-Overlooked Vulnerability An AI-powered security agent uncovered a vulnerability that had eluded human researchers for over a decade, exploiting it within 48 hours of deployment. Th
IncidentWhat Happened TeamPCP compromised Mistral AI s codebase management system, extracting nearly 450 repositories. They are selling the complete source code for $25,000 on underground forums, threatening
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened In early 2025, threat actor TeamPCP compromised TanStack s distribution infrastructure and released trojanized versions of npm and PyPI SDKs. Two OpenAI employee devices installed these
IncidentWhat Happened On May 12, Wordfence disclosed two vulnerabilities in the Avada Builder WordPress plugin, which has an estimated one million active installations. CVE-2026-4782 allows arbitrary file rea
IncidentA vulnerability in the Funnel Builder WordPress plugin allowed attackers to inject malicious JavaScript into WooCommerce checkout pages and harvest credit card data in real time. The plugin, active on
IncidentDiscovery of a Long-Standing Vulnerability In early 2025, DepthFirst AI discovered CVE-2026-42945, a heap buffer overflow vulnerability in Nginx s ngx_http_rewrite_module . This flaw had existed undet
IncidentWhat Happened On March 7, 2025, security researchers at Socket detected malicious code in three versions of node-ipc , an npm package with more than 690,000 weekly downloads. The compromised versions—
IncidentYour SIEM flagged an anomaly in authentication patterns. You asked your AI security assistant to investigate. It analyzed the logs, identified what it called malicious bot traffic, and recommended imm
IncidentWhat Happened In early 2025, security researchers at DepthFirst AI discovered CVE-2026-42945 , a vulnerability that had existed in NGINX for 18 years. The flaw affects NGINX versions 0.6.27 through 1.
IncidentWhat Happened Threat actors published malicious packages to RubyGems containing scrapers designed to target public-facing UK government servers. These packages appeared legitimate but included code th
IncidentWhat Happened CVE-2026-44338 , an authentication bypass vulnerability in PraisonAI s legacy API server, was exploited three hours and 44 minutes after public disclosure. The vulnerability affects all
IncidentOverview of the Vulnerability On April 21, 2026, security researchers at depthfirst disclosed CVE-2026-42945 , a critical vulnerability in NGINX s rewrite module that allows unauthenticated remote cod
IncidentOn January 12, 2025, OpenAI confirmed a security breach due to a supply chain attack on the TanStack ecosystem. The attack, named Mini Shai-Hulud by the extortion group TeamPCP, compromised numerous n
IncidentRapid Vulnerability Exploitation Security researchers disclosed an authentication bypass vulnerability in PraisonAI, and automated scanners probed vulnerable instances within three hours and 44 minute
