Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams142 Security Engineers142 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All142 Incident142 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

142 articles in Security Engineers · Clear filtersSort byNewest·Trending

NIST Just Handed You the CVE Problem—Here's What Happened Next

NIST Just Handed You the CVE Problem—Here's What Happened Next

The Challenge Between 2020 and 2023, CVE submissions grew 263%. Last year alone, NIST enriched almost 42,000 CVEs—a 45% year-over-year increase. Then NIST announced it would no longer analyze every vu

For Security EngineersRead article

91,000 Attack Sessions in Three Months: The Ollama Exposure Problem

91,000 Attack Sessions in Three Months: The Ollama Exposure Problem

What Happened Between October 2025 and January 2026, GreyNoise captured 91,403 distinct attack sessions targeting publicly exposed LLM inference endpoints. The primary target was Ollama instances depl

For Security EngineersRead

CVE-2026-33032: When an AI Feature Became a Remote Code Execution Vector

CVE-2026-33032: When an AI Feature Became a Remote Code Execution Vector

Overview of the Vulnerability On March 30, security researchers at Pluto Security disclosed CVE-2026-33032 , a critical vulnerability in nginx UI, a popular web-based management tool for nginx servers

For Security EngineersRead

21,764 Malicious Packages: The axios Compromise and What It Reveals About Your Dependency Chain

21,764 Malicious Packages: The axios Compromise and What It Reveals About Your Dependency Chain

What Happened In Q1 2026, Sonatype identified 21,764 open source malware packages across public repositories, with npm accounting for 75% of these. Three incidents highlighted how attackers exploit tr

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

North Korean Actors Compromised Axios npm Package: A Supply Chain Attack Teardown

North Korean Actors Compromised Axios npm Package: A Supply Chain Attack Teardown

A recent compromise of the popular Axios npm package has highlighted critical gaps in supply chain security for software development teams. Google s Threat Intelligence Group attributed the breach of

For Security EngineersRead

Integrating AI Vulnerability Scanners Into Your Security Pipeline

Integrating AI Vulnerability Scanners Into Your Security Pipeline

Your vulnerability management program is about to undergo a significant transformation. AI models that autonomously discover vulnerabilities at scale are now production tools. Your team needs a deploy

For Security EngineersRead

Audio Steganography in Package Attacks: Detection and Response Guide

Audio Steganography in Package Attacks: Detection and Response Guide

Scope This guide focuses on detecting and mitigating supply chain attacks that use audio steganography to hide malicious payloads in software packages. Our case study is the March 27, 2026 compromise

For Security EngineersRead

36 Malicious npm Packages Deployed Reverse Shells Through Strapi Plugin Typosquatting

36 Malicious npm Packages Deployed Reverse Shells Through Strapi Plugin Typosquatting

What Happened SafeDep discovered 36 malicious npm packages posing as legitimate Strapi CMS plugins. These packages exploited Redis and PostgreSQL connections to deploy reverse shells and steal credent

For Security EngineersRead

766 Hosts Compromised in 24 Hours: The React2Shell Credential Theft Campaign

766 Hosts Compromised in 24 Hours: The React2Shell Credential Theft Campaign

What Happened Between late 2024 and early 2025, attackers exploited the React2Shell vulnerability in Next.js applications to execute an automated credential theft campaign. Using a framework called NE

For Security EngineersRead

npm's Axios Package Delivered Cross-Platform RAT Through Compromised Maintainer Account

npm's Axios Package Delivered Cross-Platform RAT Through Compromised Maintainer Account

A compromised maintainer account on npm deployed a cross-platform Remote Access Trojan (RAT) through malicious versions of Axios, a widely used JavaScript HTTP client library. If your systems ran npm

For Security EngineersRead

4,000 Downloads of Malicious Code: The Cline npm Package Compromise

4,000 Downloads of Malicious Code: The Cline npm Package Compromise

What Happened The npm package Cline version 2.3.0 was compromised with malicious code that installed OpenClaw, a backdoor tool, on developer machines. This version was downloaded over 4,000 times befo

For Security EngineersRead

AI-Generated Malware in Your Dependencies: Detection Checklist

AI-Generated Malware in Your Dependencies: Detection Checklist

A recent campaign distributing over 300 poisoned packages shows how attackers now use AI to scale supply chain attacks. Your dependency scanning probably caught the known signatures, but it won t catc

For Security EngineersRead

Authentication Bypass in pac4j-jwt Exposes Java Applications

Authentication Bypass in pac4j-jwt Exposes Java Applications

What Happened CVE-2026-29000, a critical authentication bypass vulnerability in the pac4j-jwt library, allows attackers to bypass authentication controls in Java applications. The flaw was identified

For Security EngineersRead

AI Agent Turned Exfiltration Tool: The PleaseFix Vulnerability

AI Agent Turned Exfiltration Tool: The PleaseFix Vulnerability

Your AI browser agent just accessed your local file system, read your credentials, and sent them to an attacker. You didn t click anything. You didn t approve any action. The agent did it autonomously

For Security EngineersRead

"Wait, this package is suddenly asking for what permissions?"

"Wait, this package is suddenly asking for what permissions?"

These questions started showing up in security Slack channels right after StepSecurity flagged two hijacked npm packages in the React Native ecosystem. These packages, with over 30,000 downloads per w

For Security EngineersRead

Securing Your Dependency Chain Against Malicious Extensions

Securing Your Dependency Chain Against Malicious Extensions

Your build pulls in 847 dependencies. One of them just downloaded your AWS credentials. Researchers have identified dozens of malicious GlassWorm extensions in the wild, each iteration more sophistica

For Security EngineersRead

Showing 65-80 of 142 articles

PreviousPage 5 of 9Next