Expert perspectives on application security, compliance, and emerging threats
ResearchBetween July 16 and 22, 2025, three malicious packages—uuid32-utils, colorinal, and termncolor—were on PyPI delivering ZiChatBot malware. They ve been removed, but new threats are constantly emerging.
ResearchWhen a repository triggers code execution before you ve reviewed a single line, your development environment becomes an attack surface. The TrustFall vulnerability in Claude Code highlights this risk:
ResearchUniversity of Massachusetts Dartmouth researchers have introduced VulStyle, a model that detects vulnerabilities by analyzing coding style rather than just syntax or semantics. Pre-trained on approxim
ResearchThe Problem: Hidden Threats in VS Code Extensions Recently, Socket researchers found 72 malicious Open VSX extensions impersonating popular tools like ESLint and Prettier. The GlassWorm campaign explo
Get weekly security insights and compliance updates delivered to your inbox.
ResearchYour developers installed a linter yesterday. Your security team approved a formatting extension last week. Both could be exfiltrating your source code right now. Socket recently identified 73 fake VS
ResearchWhere These Questions Come From Recently, I reviewed incident reports with a team that discovered their CI/CD pipeline had been deploying vulnerable packages for three weeks. The root cause? A scanner
ResearchYour security team closed 87% of critical vulnerabilities last quarter. That sounds impressive until you realize the definition of critical just changed — and the volume tripled. OX Security s analysi
ResearchYour build pulls in 847 dependencies. One of them just downloaded your AWS credentials. Researchers have identified dozens of malicious GlassWorm extensions in the wild, each iteration more sophistica
ResearchYour SAST tools flag 2,000 issues per sprint. Your security team triages maybe 50. The rest pile up in Jira until someone archives them during spring cleaning. OpenAI s Codex Security identified 792 c
ResearchYour SAST scanner flags 47 critical vulnerabilities overnight. Your SCA tool adds 23 more. Your IaC scanner contributes another 15. By 9 AM, you re staring at 85 critical findings, and you know from e
ResearchThe Question at Hand Your security team has flagged a new AI automation framework in your environment. It s early-stage, popular in the community, and there s no confirmed exploitation yet. Should you
ResearchThe Decision You Face Your organization needs a new identity and access management (IAM) system. You re evaluating options: should you adopt an open source IAM platform that you ll need to operate and
ResearchYou re facing a potential insecure deserialization vulnerability in a web application. Crafting a proof-of-concept (PoC) usually involves tedious documentation review and payload crafting. What if you
