Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams737 Security Engineers1021 Compliance Teams275 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All737 Incident912 General270 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

737 articles in Security Engineers · Incident · Clear filtersSort byNewest·Trending

A Single Git Push Could Have Compromised GitHub's Entire Backend

Incident

Latest

3 min read

A Single Git Push Could Have Compromised GitHub's Entire Backend

What Happened In late 2024, security researchers at Wiz discovered CVE-2026-3854, a remote code execution vulnerability in GitHub s infrastructure. This flaw allowed attackers to execute arbitrary cod

For Security EngineersRead article

Cursor IDE Vulnerability: When AI Agents Execute Malicious Git Hooks

Incident

4 min read

Cursor IDE Vulnerability: When AI Agents Execute Malicious Git Hooks

Overview of the Vulnerability A critical vulnerability in Cursor IDE allowed attackers to execute arbitrary code through Git operations performed by the IDE s AI agent. This flaw, tracked as CVE-2026-

For Security EngineersRead

Unsafe Deserialization Takes Down Robotics Platform: The LeRobot CVE-2026-25874 Breakdown

Incident

4 min read

Unsafe Deserialization Takes Down Robotics Platform: The LeRobot CVE-2026-25874 Breakdown

A critical vulnerability in Hugging Face s LeRobot platform highlights the overlooked risks of using unsafe serialization formats in open-source projects. CVE-2026-25874, scoring 9.3 on CVSS, allows u

For Security EngineersRead

73 Malicious Extensions Sat Dormant in OpenVSX for Months

Incident

5 min read

73 Malicious Extensions Sat Dormant in OpenVSX for Months

What Happened Between late 2024 and early 2025, attackers planted 73 malicious extensions in the OpenVSX registry—an open-source alternative to the Visual Studio Code Marketplace. These extensions app

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Microsoft's Agent ID Administrator Flaw: A Privilege Escalation Teardown

Incident

5 min read

Microsoft's Agent ID Administrator Flaw: A Privilege Escalation Teardown

What Happened Microsoft s Entra ID (formerly Azure AD) had a role misconfiguration that allowed the Agent ID Administrator role to escalate privileges beyond its intended scope. Designed to manage aut

For Security EngineersRead

Checkmarx GitHub Repository Breach: What Happened and How to Prevent It

Incident

3 min read

Checkmarx GitHub Repository Breach: What Happened and How to Prevent It

On March 23, 2026, Checkmarx—a company specializing in application security testing tools—experienced a supply chain attack on their GitHub repository. Data from this repository later surfaced on the

For Security EngineersRead

Cryptominers Exploited Two Auth Bypass Flaws in Qinglong's Middleware

Incident

4 min read

Cryptominers Exploited Two Auth Bypass Flaws in Qinglong's Middleware

Incident Overview On February 27, 2026, researchers disclosed two authentication bypass vulnerabilities in Qinglong, an open-source task scheduler with over 19,000 GitHub stars. CVE-2026-3965 and CVE-

For Security EngineersRead

20 Hours: The Langflow RCE Exploit Timeline

Incident

4 min read

20 Hours: The Langflow RCE Exploit Timeline

What Happened A critical remote code execution vulnerability in Langflow—an open-source tool for building AI pipelines—was exploited in the wild within 20 hours of public disclosure. The vulnerability

For Security EngineersRead

Two OpenAI Vulnerabilities Expose the Input Validation Gap in AI Tools

Incident

5 min read

Two OpenAI Vulnerabilities Expose the Input Validation Gap in AI Tools

What Happened OpenAI recently patched two vulnerabilities in its AI products that could have enabled unauthorized data movement. The first, discovered by BeyondTrust researchers, affected Codex: a com

For Security EngineersRead

The Trivy Compromise: 75 Version Tags Poisoned in 24 Hours

Incident

4 min read

The Trivy Compromise: 75 Version Tags Poisoned in 24 Hours

What Happened Attackers compromised the Aqua Security repository hosting Trivy , a widely used vulnerability scanner, poisoning 75 of 76 version tags. This turned a tool meant to find vulnerabilities

For Security EngineersRead

513,000 Lines of AI Code Leaked Through a Source Map

Incident

4 min read

513,000 Lines of AI Code Leaked Through a Source Map

What Happened Security researcher Chaofan Shou recently discovered that Anthropic accidentally exposed the complete source code for Claude Code—their AI coding agent—through a public npm package. The

For Security EngineersRead

1,700 Malicious Packages: How UNC1069 Weaponized Four Package Ecosystems

Incident

5 min read

1,700 Malicious Packages: How UNC1069 Weaponized Four Package Ecosystems

What Happened Since January 2025, threat actor UNC1069—linked to North Korean groups BlueNoroff, Sapphire Sleet, and Stardust Chollima—deployed over 1,700 malicious packages across npm, PyPI, Go, and

For Security EngineersRead

21,764 Malware Packages in 90 Days: What npm's Supply Chain Crisis Teaches Us

Incident

3 min read

21,764 Malware Packages in 90 Days: What npm's Supply Chain Crisis Teaches Us

The Crisis Unfolds In Q1 2026, Sonatype identified 21,764 malicious packages in open source repositories, with npm accounting for 75% of these. That s 16,323 malicious packages targeting JavaScript de

For Security EngineersRead

AI Scans 100,000 Repositories in 72 Hours: The PRT-scan Attack

Incident

3 min read

AI Scans 100,000 Repositories in 72 Hours: The PRT-scan Attack

Overview of the Attack An attacker used an AI tool named PRT-scan to systematically scan GitHub repositories for misconfigurations that expose secrets. This attack automated the process of reconnaissa

For Security EngineersRead

Bitwarden CLI Trojan: How a GitHub Action Became a Supply Chain Weapon

Incident

4 min read

Bitwarden CLI Trojan: How a GitHub Action Became a Supply Chain Weapon

What Happened On April 22, 2025, attackers published a malicious version of the Bitwarden CLI password manager (version 2026.4.0) to the npm registry. The compromised package was available for about 1

For Security EngineersRead

Incident

Stolen Publishing Tokens: How CanisterSprawl Turned npm Maintainers Into Attack Vectors

What Happened In late 2024, security researchers at StepSecurity and Socket disclosed CanisterSprawl, an npm malware campaign that exploits developer environments to steal credentials and publish mali

For Security EngineersRead

Showing 673-688 of 737 articles

PreviousPage 43 of 47Next