Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened On May 4, 2026, security researcher CHOIGYENGMIN reported CVE-2026-8206 to Wordfence: a critical vulnerability in the Kirki WordPress plugin that allows unauthenticated attackers to hija
IncidentMicrosoft recently updated its security tools to address a critical gap: vulnerability scanners were identifying issues in code, but security teams couldn t determine which ones were significant in pr
GeneralScope - What This Guide Covers This guide focuses on access control and containment strategies for AI agents with elevated permissions in your environment. You ll find specific steps for limiting agen
IncidentWhat Happened In early 2025, attackers compromised a GitHub account with publishing access to Red Hat s @redhat-cloud-services npm namespace. They injected the Miasma malware into over 30 packages, wh
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened In late 2024 or early 2025, attackers began exploiting CVE-2024-21182, a high-severity vulnerability in Oracle WebLogic Server. This flaw allows unauthenticated attackers to compromise a
IncidentOn June 1, 2026, attackers published over 30 compromised npm packages under Red Hat s Cloud Services namespace. These packages contained Mini Shai-Hulud malware designed to exfiltrate credentials from
IncidentOn May 25, 2026, Johannes Link released jqwik version 1.10.0 to Maven Central with a deliberate prompt injection designed to sabotage AI coding agents. The Java testing library s maintainer embedded i
IncidentWhat Happened In early 2025, security researchers at Wiz discovered unauthorized code modifications in at least 32 package releases within Red Hat s npm namespace. These packages, linked to the Shai-H
IncidentOn a routine Thursday, packages under the @redhat-cloud-services namespace on npm began executing malware during installation. The compromised packages—including @redhat-cloud-services/types—ran malic
GeneralYour team likely runs static analysis on code after it s committed, scans containers before deployment, and uses software composition analysis to track known CVEs in your dependencies. However, if you
IncidentUnderstanding the Vulnerability CVE-2022-31692 revealed a critical flaw in Spring Security versions 5.6.x through 5.7.4, scoring 9.8 on the National Vulnerability Database. Applications using RegexReq
IncidentWhat Happened On January 4, CircleCI discovered unauthorized access to their systems and immediately advised all customers to rotate their secrets. The company invalidated Personal and Project API tok
IncidentWhat Happened Obsidian Security disclosed CVE-2026-40933, a critical remote code execution vulnerability in Flowise s Model Context Protocol (MCP) stdio server implementation. The vulnerability has a
IncidentWhat Happened A malicious npm package named codexui-android infiltrated the supply chain of OpenAI Codex users, exfiltrating authentication tokens to an attacker-controlled server at sentry.anyclaw[.]
IncidentWhat Happened On September 7, 2017, Equifax disclosed a breach that exposed personal information of 147 million people. The attack exploited CVE-2017-5638 , a remote code execution vulnerability in Ap
IncidentWhat Happened CVE-2022-1471 exposed a critical flaw in SnakeYaml s Constructor class, allowing arbitrary code execution through unsafe deserialization. This vulnerability affects the org.yaml:snakeyam
