Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1020 Security Engineers1020 Compliance Teams274 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All1020 Incident911 General269 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

1020 articles in Security Engineers · Clear filtersSort byNewest·Trending

Gitea RCE Exploited in the Wild: Default Settings Turned Attack Vector

Gitea RCE Exploited in the Wild: Default Settings Turned Attack Vector

Your Gitea instance just served cryptojacking malware to an attacker who never should have had access. This isn t hypothetical. CVE-2026-60004, a remote code execution vulnerability with a CVSS score

For Security EngineersRead article

24 Packages Turned npm Mirrors Into Phishing Hosts

24 Packages Turned npm Mirrors Into Phishing Hosts

What Happened OX Security discovered 24 npm packages containing malicious HTML pages designed to impersonate Cloudflare s security verification interface. The attack didn t target developers machines

For Security EngineersRead

AI Code Agents Won't Break Your Codebase If You Stop Believing These 5 Myths

AI Code Agents Won't Break Your Codebase If You Stop Believing These 5 Myths

The conversation about AI coding agents often misses the real issue. Teams debate CLI versus IDE, agentic versus copilot, autonomous versus assisted. The actual risk is clear: you re generating code f

For Security EngineersRead

A Single Prompt Poisoned the AI's Memory

A Single Prompt Poisoned the AI's Memory

What Happened Researchers from Shanghai Jiao Tong University and Ant Group have demonstrated a new attack vector called InjecMEM. This attack compromises AI agent memory systems through normal user in

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Phantom Raven: When AI Tooling Became the Entry Point

Phantom Raven: When AI Tooling Became the Entry Point

What Happened Phantom Raven is an active AI-native supply chain attack targeting developer environments through compromised open-source packages. This campaign exploits the basic developer workflow: p

For Security EngineersRead

AI Bot Security Boundary Assessment Template

AI Bot Security Boundary Assessment Template

When you deploy an AI bot into production, you re making an implicit promise about where the security boundary lies. Does each bot instance run with unique credentials? Does a compromise affect one us

For Security EngineersRead

5,000 Records Leaked Through an Exposed API Key

5,000 Records Leaked Through an Exposed API Key

What Happened South Korea s Modu-ui Changup platform, run by the Ministry of SMEs and Startups, leaked personal information and startup business ideas for about 5,000 applicants. The cause was an encr

For Security EngineersRead

Your Reachability Scanner Found 847 Vulnerabilities. How Many Matter?

Your Reachability Scanner Found 847 Vulnerabilities. How Many Matter?

The Problem A security team at a financial services company ran static analysis tools and found 847 vulnerabilities in their codebase. Their reachability scanner confirmed 312 of these could execute.

For Security EngineersRead

Security Report Triage for Open Source Maintainers

Security Report Triage for Open Source Maintainers

Scope This guide helps you evaluate and filter security findings when you maintain open source projects. It addresses the challenge of distinguishing valuable insights from noise in vulnerability repo

For Security EngineersRead

Open Source Security Tools Are Free Now

Open Source Security Tools Are Free Now

The security gap between enterprise software and open-source projects has long been evident. Enterprise teams enjoy hardened container images, automated SBOM generation, and threat intelligence feeds.

For Security EngineersRead

DAST Adoption Jumped 24% While Your Tooling Fell Behind

DAST Adoption Jumped 24% While Your Tooling Fell Behind

The Shift in Runtime Security Testing DAST adoption increased 24% year over year, with 47% of organizations now using runtime security testing. Nearly half of all organizations are scanning running ap

For Security EngineersRead

Cursor IDE Remote Code Execution: When AI Tools Attack Themselves

Cursor IDE Remote Code Execution: When AI Tools Attack Themselves

What Happened Novee s security research team discovered a vulnerability in Cursor, an AI-powered code editor, that allowed full remote code execution on a developer s workstation. The flaw exploited t

For Security EngineersRead

Containers Won't Save You from AI Code

Containers Won't Save You from AI Code

Many believe containers are the solution for isolating untrusted code. Your team might be running AI-generated code in Docker containers, trusting that namespaces and cgroups provide enough isolation.

For Security EngineersRead

Prompt Injection Took Down a Customer Service Bot

Prompt Injection Took Down a Customer Service Bot

What Happened A customer-facing LLM chatbot bypassed its safety guardrails when a user submitted input that overrode the system s original instructions. The bot disclosed internal prompts, leaked cust

For Security EngineersRead

LangChain's CVE-2026-34070: Where AI Met Path Traversal

LangChain's CVE-2026-34070: Where AI Met Path Traversal

What Happened Cyera disclosed a path traversal vulnerability in LangChain, tracked as CVE-2026-34070, with a CVSS score of 7.5. This flaw lets attackers access files outside intended directories by ma

For Security EngineersRead

Claude Code Found Zero-Days in Vim and Emacs

Claude Code Found Zero-Days in Vim and Emacs

A researcher used AI to review code, and within minutes, it flagged critical vulnerabilities in two widely used text editors. What Happened In early 2025, researcher Hung Nguyen employed Anthropic s C

For Security EngineersRead

Showing 81-96 of 1020 articles

PreviousPage 6 of 64Next