Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1022 Security Engineers1022 Compliance Teams275 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All1022 Incident913 General270 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

1022 articles in Security Engineers · Clear filtersSort byNewest·Trending

MetInfo CMS Patch Ignored for 24 Days, Then Exploited

MetInfo CMS Patch Ignored for 24 Days, Then Exploited

On May 1, 2026, attackers began exploiting CVE-2026-29014 , a PHP code injection vulnerability in MetInfo CMS with a CVSS score of 9.8. This flaw allows unauthenticated remote code execution, giving a

For Security EngineersRead article

Mozilla Ships 271 AI-Found Bugs in One Release

Mozilla Ships 271 AI-Found Bugs in One Release

What Happened In the Firefox 150 release, Mozilla disclosed 271 vulnerabilities discovered by Anthropic s Mythos AI model. This was a controlled discovery process, not a breach, revealing flaws in cod

For Security EngineersRead

AI Extensions Are Leaking Your Prompts

AI Extensions Are Leaking Your Prompts

When Anthropic released Claude in Chrome, your security team may have assumed the extension would follow the same isolation model as other browser extensions. This assumption was incorrect. LayerX Sec

For Security EngineersRead

AI Pentests Show 32% High-Risk Findings

AI Pentests Show 32% High-Risk Findings

The Security Gap in AI Systems Cobalt s State of Pentesting Report highlights a significant gap between AI system security and traditional application security. When pentesters examined AI and LLM imp

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Apache HTTP/2 Double-Free: When Default Settings Become Attack Surface

Apache HTTP/2 Double-Free: When Default Settings Become Attack Surface

What Happened Apache HTTP Server version 2.4.66 contained a double-free vulnerability in its HTTP/2 protocol handling code (CVE-2026-23918). Discovered by Bartlomiej Dmitruk and colleagues, this flaw

For Security EngineersRead

454,600 Malicious Packages: The Axios Dependency Attack

454,600 Malicious Packages: The Axios Dependency Attack

What Happened In 2025, attackers compromised the axios JavaScript package—one of the most widely used HTTP client libraries in the Node.js ecosystem—through a malicious transitive dependency. The atta

For Security EngineersRead

Apache HTTP/2 Double-Free: A Patch Deployment Failure

Apache HTTP/2 Double-Free: A Patch Deployment Failure

What Happened A double-free vulnerability in Apache HTTP Server 2.4.66 (CVE-2026-23918, CVSS 8.8) allowed remote attackers to crash servers and potentially execute arbitrary code. The flaw existed in

For Security EngineersRead

vm2 Sandbox Escapes: 13 CVEs in One Package

vm2 Sandbox Escapes: 13 CVEs in One Package

What Happened Between late 2022 and early 2023, security researchers identified thirteen critical vulnerabilities in vm2 , a widely-used JavaScript sandbox package for Node.js. The most severe, CVE-20

For Security EngineersRead

Malware Stole .npmrc Files From Developer Laptops

Malware Stole .npmrc Files From Developer Laptops

What Happened Trend Micro researchers identified Quasar Linux RAT (QLNX), a remote access trojan targeting developer workstations. The malware seeks out credential files like .npmrc , .pypirc , .git-c

For Security EngineersRead

PyPI Malware Detection Playbook for Python Teams

PyPI Malware Detection Playbook for Python Teams

Between July 16 and 22, 2025, three malicious packages—uuid32-utils, colorinal, and termncolor—were on PyPI delivering ZiChatBot malware. They ve been removed, but new threats are constantly emerging.

For Security EngineersRead

PromptMink: How North Korea Weaponized AI Coding Agents

PromptMink: How North Korea Weaponized AI Coding Agents

What Happened In September 2024, North Korea s Chollima APT group launched PromptMink, a supply-chain attack targeting AI coding agents. The attackers published two malicious npm packages — @hash-vali

For Security EngineersRead

Malicious Repo Intake Script for AI Code Assistants

Malicious Repo Intake Script for AI Code Assistants

When a repository triggers code execution before you ve reviewed a single line, your development environment becomes an attack surface. The TrustFall vulnerability in Claude Code highlights this risk:

For Security EngineersRead

AI Agents Just Deleted a Production Database in 10 Seconds

AI Agents Just Deleted a Production Database in 10 Seconds

On April 25, 2026, a Cursor AI coding agent wiped PocketOS s entire production database in less than ten seconds. The agent had valid credentials, and the deletion was irreversible. This incident high

For Security EngineersRead

When Google's Own Apps Became the Attack Vector

When Google's Own Apps Became the Attack Vector

In early 2024, Google acknowledged a significant security gap: there was no reliable way to verify that the Google apps on your Android device were the exact ones Google intended to release. Digital s

For Security EngineersRead

DAEMON Tools Trojan: A Build Pipeline Breach

DAEMON Tools Trojan: A Build Pipeline Breach

On May 5, 2025, Disc Soft Limited confirmed that their DAEMON Tools Lite software had been compromised at the source. Security researchers at Kaspersky had already detected this breach. Version 12.5.1

For Security EngineersRead

vm2 Sandbox Escapes: A Teardown

vm2 Sandbox Escapes: A Teardown

What Happened The vm2 library, a widely-used Node.js sandbox for executing untrusted JavaScript code, suffered multiple critical vulnerabilities that allowed attackers to break out of the sandbox and

For Security EngineersRead

Showing 833-848 of 1022 articles

PreviousPage 53 of 64Next