Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1022 Security Engineers1022 Compliance Teams275 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All1022 Incident913 General270 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

1022 articles in Security Engineers · Clear filtersSort byNewest·Trending

AI Worm Hits Unnamed Enterprise: What Failed

AI Worm Hits Unnamed Enterprise: What Failed

IMPORTANT NOTICE : This teardown analyzes a hypothetical scenario based on researcher predictions about AI worm capabilities. As of this writing, no documented enterprise breach by an autonomous AI wo

For Security EngineersRead article

China-Linked OP-512 Exploits IIS: Detection Playbook

China-Linked OP-512 Exploits IIS: Detection Playbook

ReliaQuest has identified a threat cluster named OP-512 deploying custom web shell frameworks against Microsoft IIS servers, with moderate to high confidence attribution to China-based actors. The fra

For Security EngineersRead

Microsoft Adds Seven AI Failure Modes: What Broke

Microsoft Adds Seven AI Failure Modes: What Broke

Microsoft recently expanded its agentic AI security taxonomy with seven new failure modes. These patterns emerged from incidents involving deployed AI systems. If you re running AI agents in productio

For Security EngineersRead

29,300 Attack Attempts on a Single WordPress Plugin

29,300 Attack Attempts on a Single WordPress Plugin

What Happened Between March 18 and today, attackers launched over 29,300 attempts to exploit WordPress sites using Everest Forms Pro, a premium form builder plugin. The vulnerability, tracked as CVE-2

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

CVE-2022-42889: When Default Interpolators Became Attack Vectors

CVE-2022-42889: When Default Interpolators Became Attack Vectors

A remote code execution vulnerability in Apache Commons Text surfaced in October 2022, affecting versions 1.5.x through 1.9.x. While not as widespread as Log4Shell, CVE-2022-42889 highlights how trans

For Security EngineersRead

OpenSSL 3.0.7: Seven Days From Alert to Patch

OpenSSL 3.0.7: Seven Days From Alert to Patch

What Happened On October 25, 2022, the OpenSSL project announced a critical vulnerability in OpenSSL 3.0.x. The patch was released on November 1, 2022, providing organizations exactly seven days to pr

For Security EngineersRead

Prompt Injection Took Over Claude Code Repos

Prompt Injection Took Over Claude Code Repos

A malicious GitHub issue could hijack your entire repository. Security researcher RyotaK demonstrated this by finding a critical flaw in Anthropic s Claude Code GitHub Action, identifying around 50 wa

For Security EngineersRead

57 Packages Hijacked Through binding.gyp Files

57 Packages Hijacked Through binding.gyp Files

What Happened Between late 2024 and early 2025, attackers compromised 57 npm packages using a technique that bypasses common security controls. Instead of hiding code in lifecycle scripts like preinst

For Security EngineersRead

36 npm Packages Poisoned by Credential-Harvesting Malware

36 npm Packages Poisoned by Credential-Harvesting Malware

IronWorm malware infiltrated 36 npm packages with a single goal: steal everything your CI/CD pipeline knows about your infrastructure. JFrog researchers caught the attack early, but the incident expos

For Security EngineersRead

npm Install Audit Script for binding.gyp Attacks

npm Install Audit Script for binding.gyp Attacks

Your package.json scripts are clean. Your lockfile passes integrity checks. You run npm audit before every deployment. Yet, you re still vulnerable to the attack vector that compromised 281 npm packag

For Security EngineersRead

AI Workloads in Kubernetes: A Security Implementation Playbook

AI Workloads in Kubernetes: A Security Implementation Playbook

Your Kubernetes cluster is running inference endpoints that make thousands of external API calls per minute. Your AI agents are spinning up containers to execute code they generated. Your security pol

For Security EngineersRead

Rust Malware Targets Your Package Manager

Rust Malware Targets Your Package Manager

Scope This guide addresses credential theft and malware propagation through package registries, focusing on the NPM ecosystem. You ll find steps for detecting supply chain compromise, hardening develo

For Security EngineersRead

6,000 Stores, One Cookie: The Mirasvit RCE Breakdown

6,000 Stores, One Cookie: The Mirasvit RCE Breakdown

What Happened An unauthenticated attacker can execute arbitrary PHP code on Magento stores running the Mirasvit Cache Warmer extension by sending a malicious cookie. CVE-2026-45247 , a PHP object inje

For Security EngineersRead

Gemini's Notification Flaw: An LLM Vulnerability Teardown

Gemini's Notification Flaw: An LLM Vulnerability Teardown

A prompt injection vulnerability in Google Gemini s voice assistant shows how AI systems can be exploited through seemingly harmless notification channels. Here s what happened, what failed, and what

For Security EngineersRead

Lazarus Group Brandjacks npm Packages

Lazarus Group Brandjacks npm Packages

What Happened Between late 2024 and early 2025, the Lazarus Group deployed malicious packages on npm that mimicked legitimate ecosystem tools without relying on typosquatting. Sonatype s research team

For Security EngineersRead

Redis RCE Flaw Went Undetected for Two Years

Redis RCE Flaw Went Undetected for Two Years

What Happened On May 5, 2025, Redis released patches addressing CVE-2026-23479, a critical remote code execution vulnerability present since version 7.2.0. This flaw allows authenticated users to exec

For Security EngineersRead

Showing 641-656 of 1022 articles

PreviousPage 41 of 64Next