Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams560 Security Engineers759 Compliance Teams223 DevOps Leaders63 Developers31 CISOs17 IT Directors2

Topics:All560 Incident707 General188 Standards88 Research61 Guides34 Deadlines11 Vendor News4 Legal2

560 articles in Security Engineers · Incident · Clear filtersSort byNewest·Trending

Vulnerability Disclosure Without a Program: What Happens When Researchers Find Your Flaws First

Incident

Latest

4 min read

Vulnerability Disclosure Without a Program: What Happens When Researchers Find Your Flaws First

The Problem In 2024, CISA and four international cybersecurity agencies released joint guidance urging software vendors to establish formal coordinated vulnerability disclosure (CVD) programs. This wa

For Security EngineersRead article

Token Mixup: n8n's Cross-Issuer Login Flaw

Incident

4 min read

Token Mixup: n8n's Cross-Issuer Login Flaw

On June 24, 2026, n8n patched CVE-2026-59208, a vulnerability in their token exchange mechanism that allowed attackers to authenticate as users from a different token issuer. If your Enterprise instan

For Security EngineersRead

SAP NetWeaver CVSS 9.9 Flaw: What Went Wrong

Incident

4 min read

SAP NetWeaver CVSS 9.9 Flaw: What Went Wrong

SAP s July 2026 security update included CVE-2026-44747 , an out-of-bounds write vulnerability in NetWeaver Application Server ABAP with a CVSS score of 9.9. This flaw allows an authenticated attacker

For Security EngineersRead

GPT-5.6 Sol Prompt Injection: What OpenAI's Red Team Found

Incident

4 min read

GPT-5.6 Sol Prompt Injection: What OpenAI's Red Team Found

What Happened OpenAI used GPT-Red, an automated adversarial testing system, to identify prompt injection vulnerabilities in GPT-5.6 Sol before its release. The testing showed that earlier versions wer

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

AI Agent Clicked "Delete All" Instead of "Read More"

Incident

5 min read

AI Agent Clicked "Delete All" Instead of "Read More"

In December 2024, researchers at Seoul National University demonstrated a new attack that made AI agents perform unintended actions. This attack succeeded up to 50% of the time against current defense

For Security EngineersRead

Unpatched for 8 Months: Claude Extension Flaw

Incident

4 min read

Unpatched for 8 Months: Claude Extension Flaw

What Happened Anthropic s Claude for Chrome extension has two vulnerabilities that allow malicious browser extensions to hijack the AI s capabilities to read and exfiltrate user data. Security researc

For Security EngineersRead

AI Found a Zero-Day in WordPress: What Broke

Incident

5 min read

AI Found a Zero-Day in WordPress: What Broke

Intruder s security research team discovered a SQL injection vulnerability in the Creative Mail plugin for WordPress using an automated pipeline that combines traditional code scanning with AI analysi

For Security EngineersRead

Two Joomla Extensions Under Active Attack

Incident

4 min read

Two Joomla Extensions Under Active Attack

CISA issued Emergency Directive 25-01 on January 15, 2025, ordering federal agencies to patch or mitigate two remote code execution vulnerabilities in Joomla extensions within 72 hours. The flaws in i

For Security EngineersRead

SAP Patches Three Critical Flaws: What Went Wrong

Incident

4 min read

SAP Patches Three Critical Flaws: What Went Wrong

What Happened SAP released 16 security patches in July 2026, including three critical vulnerabilities that could let attackers access unauthorized data, crash systems, or trigger denial-of-service con

For Security EngineersRead

AI Agents Hit Admin in 93% of Runs Until This Defense Worked

Incident

5 min read

AI Agents Hit Admin in 93% of Runs Until This Defense Worked

What Happened Tracebit researchers conducted an experiment that should concern anyone developing AI-powered security tools. They deployed autonomous AI agents in test environments to see how quickly t

For Security EngineersRead

Jscrambler npm Package Backdoored: A Supply Chain Breach Teardown

Incident

4 min read

Jscrambler npm Package Backdoored: A Supply Chain Breach Teardown

On a typical Tuesday, a widely-used JavaScript protection tool became an attack vector. The Jscrambler npm package , trusted by development teams for code obfuscation and security, was compromised wit

For Security EngineersRead

Cursor IDE Executes Malicious Code After Ignored Disclosure

Incident

4 min read

Cursor IDE Executes Malicious Code After Ignored Disclosure

What Happened In December 2024, security researchers disclosed a vulnerability in Cursor, an AI-powered code editor, that allows automatic execution of malicious code when a developer opens a compromi

For Security EngineersRead

400 Scripts, 300 Servers, One GenAI Breach

Incident

4 min read

400 Scripts, 300 Servers, One GenAI Breach

What Happened Attackers used generative AI to create over 400 custom exploitation scripts, compromising more than 300 servers in a single breach. The speed and scale were beyond human capability. This

For Security EngineersRead

5 Million Alerts: What Google's AI Agent Numbers Tell Us About Human-Scale Security

Incident

4 min read

5 Million Alerts: What Google's AI Agent Numbers Tell Us About Human-Scale Security

Overview Google Cloud recently introduced AI-powered security agents at Next 26, highlighting that its Triage and Investigation agent processed over 5 million alerts in the past year. Additionally, Go

For Security EngineersRead

Mythos Finds 1,000 Bugs in 10 Hours: Where EPSS Fits In

Incident

4 min read

Mythos Finds 1,000 Bugs in 10 Hours: Where EPSS Fits In

What Happened In October 2024, Anthropic deployed an AI agent called Mythos to scan its codebase. The system identified roughly 1,000 potential vulnerabilities in just 10 hours. For context, that s ab

For Security EngineersRead

Joomla Zero-Days: What Two File Upload Flaws Reveal About CMS Defense

Incident

4 min read

Joomla Zero-Days: What Two File Upload Flaws Reveal About CMS Defense

What Happened Two Joomla extensions, iCagenda and Balbooa Forms, contained critical file upload vulnerabilities that attackers exploited before patches were available. CVE-2026-48939 (iCagenda) and CV

For Security EngineersRead

Showing 65-80 of 560 articles

PreviousPage 5 of 35Next