Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams86 Security Engineers142 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All86 Incident142 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

86 articles in Security Engineers · Incident · Clear filtersSort byNewest·Trending

Zero-Day in 1.4 Billion Devices: The Qualcomm CVE-2026-21385 Exploit

Incident

Latest

4 min read

Zero-Day in 1.4 Billion Devices: The Qualcomm CVE-2026-21385 Exploit

What Happened Threat actors exploited CVE-2026-21385 , a high-severity memory corruption vulnerability in Qualcomm chipsets, in targeted attacks against Android devices. Security researchers identifie

For Security EngineersRead article

Spy-Grade iOS Exploit Kit Now Powering Financial Crime

Incident

4 min read

Spy-Grade iOS Exploit Kit Now Powering Financial Crime

What Happened Between February and late 2025, threat actors deployed Coruna—an iOS exploit kit containing five complete exploit chains and 23 individual exploits—against targets ranging from iPhone mo

For Security EngineersRead

Zero-Click RCE in FreeScout: When Your Help Desk Becomes the Entry Point

Incident

3 min read

Zero-Click RCE in FreeScout: When Your Help Desk Becomes the Entry Point

Overview of the Vulnerability Security researchers at OX Security disclosed CVE-2026-28289 , a critical vulnerability in FreeScout, an open-source, self-hosted help desk platform. This flaw allows una

For Security EngineersRead

Two Years of AI Infrastructure Exploitation: What Wiz Researchers Found

Incident

3 min read

Two Years of AI Infrastructure Exploitation: What Wiz Researchers Found

Overview of Findings Security researchers at Wiz spent two years examining AI infrastructure deployments to uncover exploitable vulnerabilities. Their findings reveal that while many teams focus on pr

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

When Your AI Coding Assistant Becomes an Exfiltration Tool

Incident

4 min read

When Your AI Coding Assistant Becomes an Exfiltration Tool

Incident Overview Orca Security discovered RoguePilot, a vulnerability in GitHub Codespaces that allowed attackers to manipulate GitHub Copilot into leaking GITHUB_TOKEN credentials. Attackers embedde

For Security EngineersRead

A Financial Services Team Discovers Their Load Balancer Is the Weakest Link

Incident

4 min read

A Financial Services Team Discovers Their Load Balancer Is the Weakest Link

The Challenge A financial services organization believed they had a robust security architecture with WAFs , application-layer security controls, runtime protection, and comprehensive monitoring. Howe

For Security EngineersRead

OAuth Error Flow Attacks Hit Government Networks: A Technical Breakdown

Incident

4 min read

OAuth Error Flow Attacks Hit Government Networks: A Technical Breakdown

Attack Overview Attackers have targeted government and public-sector organizations by exploiting OAuth 2.0 s error handling mechanisms. The attack began with phishing emails containing malicious links

For Security EngineersRead

4,000 Downloads in Eight Hours: Anatomy of the Cline CLI Supply Chain Attack

Incident

5 min read

4,000 Downloads in Eight Hours: Anatomy of the Cline CLI Supply Chain Attack

What Happened On February 17, 2026, an attacker exploited a compromised npm publish token to release Cline CLI version 2.3.0, an unauthorized update that installed OpenClaw on developer systems. This

For Security EngineersRead

Incident

3 min read

OAuth Credentials Stored as Executable HTML: The n8n XSS Incident

Overview of the Incident On February 6, n8n released version 2.6.4 to address a stored cross-site scripting (XSS) vulnerability in its handling of OAuth credentials. Security researchers at Imperva fo

For Security EngineersRead

A Threat Intelligence Program That Couldn't Detect Threats

Incident

4 min read

A Threat Intelligence Program That Couldn't Detect Threats

Your security team invested in threat intelligence feeds, built a threat modeling framework, and ran quarterly vulnerability assessments. Yet, an adversary exploited a gap you d documented but never v

For Security EngineersRead

ClawJacked: How a Browser Tab Hijacked an AI Platform Through Localhost

Incident

4 min read

ClawJacked: How a Browser Tab Hijacked an AI Platform Through Localhost

What Happened OpenClaw, a self-hosted AI platform, had a vulnerability that allowed malicious websites to hijack local instances through brute-force password attacks. The attack was simple: a user vis

For Security EngineersRead

The API Key That Gave Away the Store: An LLM Endpoint Breach Teardown

Incident

5 min read

The API Key That Gave Away the Store: An LLM Endpoint Breach Teardown

What Happened Your development team deployed an internal LLM service with an exposed API endpoint for rapid prototyping. The endpoint used a hardcoded API key with broad permissions to access the orga

For Security EngineersRead

An AI Bot Published a Malicious npm Package for Eight Hours

Incident

4 min read

An AI Bot Published a Malicious npm Package for Eight Hours

On a Tuesday morning, developers running npm update unknowingly downloaded [email protected] — an unauthorized release published without human approval. The package remained live for eight hours, during whi

For Security EngineersRead

The Calendar Invitation That Hijacked an AI Agent

Incident

4 min read

The Calendar Invitation That Hijacked an AI Agent

What Happened Researchers demonstrated a successful promptware attack against Google s AI systems using a simple calendar invitation. The attack began when an AI agent processed a malicious Google Cal

For Security EngineersRead

When Static Analysis Flagged 847 Vulnerabilities (But Only 3 Were Real)

Incident

4 min read

When Static Analysis Flagged 847 Vulnerabilities (But Only 3 Were Real)

The Problem A mid-sized fintech company s security team spent three weeks triaging 847 vulnerabilities flagged by their static analysis tool during a pre-release audit. After manual investigation, the

For Security EngineersRead

When Vulnerability Scanning and Patch Deployment Don't Talk to Each Other

Incident

4 min read

When Vulnerability Scanning and Patch Deployment Don't Talk to Each Other

The Problem A mid-sized financial services company found a critical authentication bypass vulnerability in their customer portal during a routine scan. The vulnerability management team logged it, ass

For Security EngineersRead

Showing 65-80 of 86 articles

PreviousPage 5 of 6Next