Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams142 Security Engineers142 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All142 Incident142 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

142 articles in Security Engineers · Clear filtersSort byNewest·Trending

AppsFlyer SDK Compromise: How a Marketing Tool Became a Cryptocurrency Theft Vector

AppsFlyer SDK Compromise: How a Marketing Tool Became a Cryptocurrency Theft Vector

What Happened Between March 9 and March 11, 2025, attackers compromised the AppsFlyer Web SDK, injecting malicious JavaScript to steal cryptocurrency. The code targeted cryptocurrency wallet addresses

For Security EngineersRead article

88 Malicious npm Packages Still Active: What the PhantomRaven Data Tells Us

88 Malicious npm Packages Still Active: What the PhantomRaven Data Tells Us

Endor Labs researchers have identified 88 new malicious npm packages in the latest PhantomRaven campaign—81 of which are still available for download. These packages are actively stealing credentials

For Security EngineersRead

Stopping Self-Spreading Worms When You Can't Kill the Server

Stopping Self-Spreading Worms When You Can't Kill the Server

On March 20, 2026, Aikido Security detected CanisterWorm spreading across the npm ecosystem. Within hours, it had compromised more than 50 packages across multiple scopes. The attack used the Internet

For Security EngineersRead

Defending Against Decentralized Malware: What the CanisterWorm Attack Means for Your Supply Chain

Defending Against Decentralized Malware: What the CanisterWorm Attack Means for Your Supply Chain

Scope This guide covers detection and mitigation strategies for supply chain attacks using decentralized infrastructure for command-and-control operations. You ll learn to identify compromised package

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

AI Agents Aren't Just Fancy Chatbots: 5 Security Myths That Will Get You Breached

AI Agents Aren't Just Fancy Chatbots: 5 Security Myths That Will Get You Breached

Your security team might think of AI agents like web applications, but this assumption creates a new attack surface. When CNCERT warned about OpenClaw s vulnerabilities—specifically its inherently wea

For Security EngineersRead

AI Scanners Found 11,000 Vulnerabilities in 30 Days—Here's How to Deploy One

AI Scanners Found 11,000 Vulnerabilities in 30 Days—Here's How to Deploy One

Your SAST tools flag 2,000 issues per sprint. Your security team triages maybe 50. The rest pile up in Jira until someone archives them during spring cleaning. OpenAI s Codex Security identified 792 c

For Security EngineersRead

AI Scanner Misses SQL Injection in Payment Flow — A Case Study in Tool Limitations

AI Scanner Misses SQL Injection in Payment Flow — A Case Study in Tool Limitations

What Happened A Series B fintech company integrated an AI-powered vulnerability scanner into their CI/CD pipeline to reduce false positives from their previous SAST tool. The AI scanner was part of a

For Security EngineersRead

83,000 Downloads of a Critical Auth Bypass in One Week

83,000 Downloads of a Critical Auth Bypass in One Week

What Happened On January 15, 2025, researchers disclosed CVE-2026-29000 , a critical authentication bypass vulnerability in pac4j-jwt, a widely-used Java authentication library. The flaw affects the J

For Security EngineersRead

AI Agent Leaked Customer PII Through Autonomous Email Actions

AI Agent Leaked Customer PII Through Autonomous Email Actions

What Happened Your organization deployed an AI agent with broad permissions to handle customer support inquiries. This agent was set up to autonomously draft and send email responses, access customer

For Security EngineersRead

OAuth2-proxy Authentication Bypass: A Header Smuggling Breakdown

OAuth2-proxy Authentication Bypass: A Header Smuggling Breakdown

A single HTTP header with an underscore instead of a hyphen bypassed authentication for an entire OAuth2-proxy deployment. No brute force. No stolen credentials. Just X_Forwarded_User instead of X-For

For Security EngineersRead

When AI Pentesting Tools Miss What Matters: A Burp AI Case Study

When AI Pentesting Tools Miss What Matters: A Burp AI Case Study

Understanding the Gap in AI Pentesting CyberMaddy, a security researcher, evaluated Burp AI s vulnerability detection capabilities using test web applications. The tool identified common vulnerabiliti

For Security EngineersRead

A Zero-Width Space Character Broke FreeScout's Security

A Zero-Width Space Character Broke FreeScout's Security

What Happened OX Security discovered CVE-2026-28289 , a zero-click remote code execution vulnerability in FreeScout, an open-source helpdesk platform. This flaw allowed attackers to execute arbitrary

For Security EngineersRead

Zero-Day in 1.4 Billion Devices: The Qualcomm CVE-2026-21385 Exploit

Zero-Day in 1.4 Billion Devices: The Qualcomm CVE-2026-21385 Exploit

What Happened Threat actors exploited CVE-2026-21385 , a high-severity memory corruption vulnerability in Qualcomm chipsets, in targeted attacks against Android devices. Security researchers identifie

For Security EngineersRead

Tire Pressure Sensors Are Broadcasting Your Location: A Security Engineer's Field Guide to Automotive IoT Vulnerabilities

Tire Pressure Sensors Are Broadcasting Your Location: A Security Engineer's Field Guide to Automotive IoT Vulnerabilities

Scope This guide addresses the cybersecurity risks inherent in Tire Pressure Monitoring Systems (TPMS) and similar automotive IoT components. You ll find guidance for security teams evaluating connect

For Security EngineersRead

Spy-Grade iOS Exploit Kit Now Powering Financial Crime

Spy-Grade iOS Exploit Kit Now Powering Financial Crime

What Happened Between February and late 2025, threat actors deployed Coruna—an iOS exploit kit containing five complete exploit chains and 23 individual exploits—against targets ranging from iPhone mo

For Security EngineersRead

Zero-Click RCE in FreeScout: When Your Help Desk Becomes the Entry Point

Zero-Click RCE in FreeScout: When Your Help Desk Becomes the Entry Point

Overview of the Vulnerability Security researchers at OX Security disclosed CVE-2026-28289 , a critical vulnerability in FreeScout, an open-source, self-hosted help desk platform. This flaw allows una

For Security EngineersRead

Showing 81-96 of 142 articles

PreviousPage 6 of 9Next