Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1022 Security Engineers1022 Compliance Teams275 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All1022 Incident913 General270 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

1022 articles in Security Engineers · Clear filtersSort byNewest·Trending

Two Major Breaches, One Supply Chain Failure

Two Major Breaches, One Supply Chain Failure

On January 15, 2025, GitHub disclosed that attackers accessed internal repositories and exfiltrated source code. Days later, Grafana Labs confirmed a similar breach. Both incidents traced back to a su

For Security EngineersRead article

Open-Source AI Security Tools Won't Fix Your Problems

Open-Source AI Security Tools Won't Fix Your Problems

The Conventional Wisdom Security teams are excited about Microsoft s release of Clarity and RAMPART, viewing them as transformative for AI security. The idea is straightforward: integrate these open-s

For Security EngineersRead

Two KEV Additions, One Lesson: Patch Before Threat Actors Do

Two KEV Additions, One Lesson: Patch Before Threat Actors Do

What Happened Between May 15 and May 21, 2025, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. CVE-2025-34291, an origin valid

For Security EngineersRead

Treasury Breach: A 15-Year-Old Flaw

Treasury Breach: A 15-Year-Old Flaw

What Happened In December 2024, state-sponsored attackers exploited a PostgreSQL SQL injection zero-day to infiltrate the US Treasury. This vulnerability allowed them to bypass authentication controls

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

ChromaDB CVE-2026-45829: Race Condition to RCE

ChromaDB CVE-2026-45829: Race Condition to RCE

Overview of the Vulnerability ChromaDB versions 1.0.0 through 1.5.8 have a critical vulnerability allowing unauthenticated remote code execution. The flaw, tracked as CVE-2026-45829, exploits a race c

For Security EngineersRead

1,467 Malicious AI Skills Found in ClawHub

1,467 Malicious AI Skills Found in ClawHub

An AI agent you deploy to automate customer support queries suddenly starts leaking API keys to an external server. Your incident response team traces it back to a helpful skill you installed three we

For Security EngineersRead

Google's 72 Open-Source Fixes: What CodeMender's Integration Reveals About AI Security Governance

Google's 72 Open-Source Fixes: What CodeMender's Integration Reveals About AI Security Governance

Introduction Google s integration of CodeMender, an AI-powered vulnerability remediation agent, into the Gemini Enterprise Agent Platform marks a strategic shift in AI security governance. This move d

For Security EngineersRead

Next.js Middleware Bypass: CVE-2026-44575

Next.js Middleware Bypass: CVE-2026-44575

What Happened CVE-2026-44575 allows attackers to bypass middleware-based authorization controls in Next.js App Router applications through manipulated request paths. The vulnerability affects Next.js

For Security EngineersRead

3,800 Repos Stolen in 18 Minutes

3,800 Repos Stolen in 18 Minutes

On May 18, 2026, GitHub disclosed a breach of its internal repositories. The attack vector: a trojanized VS Code extension called Nx Console, maintained by Narwhal Technologies. The compromised versio

For Security EngineersRead

API Keys Die Instantly When You Delete Them, Right?

API Keys Die Instantly When You Delete Them, Right?

A security researcher deleted a Google API key and watched it authenticate successfully for the next 23 minutes. The provider s documentation claimed immediate deactivation. This gap between promise a

For Security EngineersRead

3,800 GitHub Repos Breached via VS Code Extension

3,800 GitHub Repos Breached via VS Code Extension

What Happened Attackers compromised the Nx Console VS Code extension and published a malicious version to the Visual Studio Marketplace. This version exfiltrated authentication tokens from developers

For Security EngineersRead

PolinRider Used Blockchain to Hide Malware in npm Package

PolinRider Used Blockchain to Hide Malware in npm Package

What Happened Between late 2024 and early 2025, attackers compromised two versions of the npm package @common-stack/generate-plugin (9.0.2-alpha.21 and 9.0.2-alpha.22). The package, which sees over 1,

For Security EngineersRead

AI Security Benchmarks Are Failing: What to Measure Instead

AI Security Benchmarks Are Failing: What to Measure Instead

Security engineers have spent decades developing reliable methods to measure software security. However, with the advent of AI systems, these measurements have become ineffective. The issue isn t that

For Security EngineersRead

AI Agent Security: Five Myths Blocking Your Defense

AI Agent Security: Five Myths Blocking Your Defense

Your AI agent just guided a developer through installing a malicious package. Your static analysis tools found nothing wrong. Your endpoint detection and response (EDR) didn t trigger. Your code revie

For Security EngineersRead

Drupal CVE-2026-9082: When Anonymous Users Get RCE

Drupal CVE-2026-9082: When Anonymous Users Get RCE

What Happened Drupal recently released emergency security updates for six supported versions to patch CVE-2026-9082 , a vulnerability that allows anonymous users to execute remote code on sites using

For Security EngineersRead

When Equifax Ignored Its Own DAST Findings

When Equifax Ignored Its Own DAST Findings

Equifax s Security Oversight In 2017, Equifax suffered a massive data breach that exposed the personal information of 147 million people. The breach was due to an unpatched Apache Struts vulnerability

For Security EngineersRead

Showing 737-752 of 1022 articles

PreviousPage 47 of 64Next