Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams142 Security Engineers142 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All142 Incident142 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

142 articles in Security Engineers · Clear filtersSort byNewest·Trending

Bitwarden CLI Trojan: How a GitHub Action Became a Supply Chain Weapon

Bitwarden CLI Trojan: How a GitHub Action Became a Supply Chain Weapon

What Happened On April 22, 2025, attackers published a malicious version of the Bitwarden CLI password manager (version 2026.4.0) to the npm registry. The compromised package was available for about 1

For Security EngineersRead article

Malicious npm Package Impersonates Bitwarden CLI: Three Attack Vectors in One

Malicious npm Package Impersonates Bitwarden CLI: Three Attack Vectors in One

On April 23, 2026, Mend.io discovered a compromised package on npm masquerading as @bitwarden/cli version 2026.4.0. This package combined three attack mechanisms: a self-propagating npm worm, a GitHub

For Security EngineersRead

Stolen Publishing Tokens: How CanisterSprawl Turned npm Maintainers Into Attack Vectors

Stolen Publishing Tokens: How CanisterSprawl Turned npm Maintainers Into Attack Vectors

What Happened In late 2024, security researchers at StepSecurity and Socket disclosed CanisterSprawl, an npm malware campaign that exploits developer environments to steal credentials and publish mali

For Security EngineersRead

Claude Found RCE Bugs in Vim and Emacs That Fire When You Open a File

Claude Found RCE Bugs in Vim and Emacs That Fire When You Open a File

What Happened An AI assistant discovered remote code execution (RCE) vulnerabilities in two widely-used text editors: Vim and GNU Emacs. These vulnerabilities do not require complex exploits or user i

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Google's Antigravity Tool: When Prompt Injection Becomes Remote Code Execution

Google's Antigravity Tool: When Prompt Injection Becomes Remote Code Execution

What Happened Google patched a critical remote code execution vulnerability in Antigravity, an internal AI-based tool. The flaw arose from a prompt-injection vulnerability that allowed attackers to es

For Security EngineersRead

13 Hours: An SSRF Vulnerability Goes from Disclosure to Active Exploitation

13 Hours: An SSRF Vulnerability Goes from Disclosure to Active Exploitation

What Happened When CVE-2026-33626 was disclosed, attackers quickly began exploiting a server-side request forgery (SSRF) vulnerability in LMDeploy, an open-source toolkit for deploying large language

For Security EngineersRead

Bitwarden CLI Package Breach: How a Compromised GitHub Action Stole Developer Credentials

Bitwarden CLI Package Breach: How a Compromised GitHub Action Stole Developer Credentials

What Happened On April 22, 2026, the @bitwarden/cli npm package was compromised with malicious code aiming to steal developer credentials. This package was available from 5:57 PM to 7:30 PM ET. During

For Security EngineersRead

A 9.3 CVSS Vulnerability That Will Never Be Patched

A 9.3 CVSS Vulnerability That Will Never Be Patched

What Happened CVE-2026-5752, a critical vulnerability in Cohere AI s Terrarium sandbox, allows attackers to execute arbitrary code with root privileges and escape container isolation. This flaw exploi

For Security EngineersRead

An Attacker Executed Code Through Your AI Agent and You Never Saw It

An Attacker Executed Code Through Your AI Agent and You Never Saw It

Understanding the Vulnerability OX Security disclosed a critical vulnerability in Anthropic s Model Context Protocol (MCP) SDK that enables remote code execution across Python, TypeScript, Java, and R

For Security EngineersRead

A Self-Propagating Worm Just Proved Your Dependency Security Model Is Broken

A Self-Propagating Worm Just Proved Your Dependency Security Model Is Broken

Socket and StepSecurity detected a supply chain worm in npm packages that doesn t just steal credentials—it spreads itself. The attack, tracked as CanisterSprawl, uses postinstall hooks to exfiltrate

For Security EngineersRead

Grafana's AI Dashboard Flaw: When LLM Integration Bypasses URL Validation

Grafana's AI Dashboard Flaw: When LLM Integration Bypasses URL Validation

Overview of the Vulnerability Noma Security has disclosed a vulnerability in Grafana s AI-powered dashboards, allowing attackers to exfiltrate sensitive data through indirect prompt injection. This fl

For Security EngineersRead

CVE-2025-59528: When a CVSS-10 Vulnerability Meets 15,000 Exposed Instances

CVE-2025-59528: When a CVSS-10 Vulnerability Meets 15,000 Exposed Instances

What Happened Flowise, an open-source low-code platform for building AI chatbots and workflows, was found to have CVE-2025-59528—a critical arbitrary JavaScript code injection vulnerability. This flaw

For Security EngineersRead

10 Hours: The Marimo RCE Exploit Timeline

10 Hours: The Marimo RCE Exploit Timeline

What Happened A remote code execution vulnerability in Marimo, an open-source Python notebook platform, was exploited within 10 hours of public disclosure. The flaw, tracked as CVE-2026-39987, affects

For Security EngineersRead

Under 10 Hours: How an Unauthenticated RCE Became Full System Compromise

Under 10 Hours: How an Unauthenticated RCE Became Full System Compromise

What Happened On a Friday in early 2025, CoreWeave disclosed CVE-2026-39987 , a critical remote code execution vulnerability in Marimo, their Python notebook platform. This flaw allowed attackers to e

For Security EngineersRead

"We're drowning in CVEs" — What NIST's triage shift means for your vulnerability program

"We're drowning in CVEs" — What NIST's triage shift means for your vulnerability program

Your team likely relies on the NVD scores to decide what to patch, with automation pulling CVSS data to prioritize remediation. Now, NIST is shifting its focus, having enriched nearly 42,000 CVEs in 2

For Security EngineersRead

When the National Vulnerability Database Stopped Enriching Most CVEs

When the National Vulnerability Database Stopped Enriching Most CVEs

What Happened In 2025, the National Vulnerability Database (NVD) announced it would no longer provide enrichment data—such as CVSS scores, CWE classifications, and affected product configurations—for

For Security EngineersRead

Showing 49-64 of 142 articles

PreviousPage 4 of 9Next