Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams555 Security Engineers759 Compliance Teams223 DevOps Leaders63 Developers31 CISOs17 IT Directors2

Topics:All555 Incident707 General188 Standards88 Research61 Guides34 Deadlines11 Vendor News4 Legal2

555 articles in Security Engineers · Incident · Clear filtersSort byNewest·Trending

Incident

Latest

4 min read

3,000 Components, Zero Visibility

What Happened A mid-market SaaS company discovered unauthorized data access in their production environment. The entry point wasn t their code. An attacker exploited a known vulnerability in a third-p

For Security EngineersRead article

Zero-CVE Package Became the Attack Vector

Incident

4 min read

Zero-CVE Package Became the Attack Vector

What Happened A software supply chain compromise occurred when your team integrated what appeared to be a clean open-source dependency. The package showed zero CVEs in your security scanning tools. Th

For Security EngineersRead

AI Code Reviewers Missed This Attack 79 Times

Incident

4 min read

AI Code Reviewers Missed This Attack 79 Times

A research team at the University of Missouri-Kansas City has published proof-of-concept code for an attack that bypasses AI code review tools by hiding malicious instructions inside PNG files attache

For Security EngineersRead

Injective Labs Supply Chain Attack: 18 Packages Compromised in 24 Hours

Incident

4 min read

Injective Labs Supply Chain Attack: 18 Packages Compromised in 24 Hours

What Happened On July 8, 2026, a threat actor published version 1.20.21 of @injectivelabs/sdk-ts to npm. The package contained code to steal cryptocurrency wallet private keys. Within 24 hours, the at

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Gitea Auth Bypass: One Header, Full Admin

Incident

4 min read

Gitea Auth Bypass: One Header, Full Admin

On January 14, 2025, security researcher Michael Clark confirmed what Sysdig had already detected: attackers were exploiting CVE-2026-20896 to bypass authentication in Gitea Docker deployments. This v

For Security EngineersRead

Seven Ubiquiti Flaws Exposed 100,000 Devices

Incident

4 min read

Seven Ubiquiti Flaws Exposed 100,000 Devices

Ubiquiti recently released security updates for UniFi OS, addressing seven critical vulnerabilities. One of these, CVE-2026-50746, has a maximum CVSS severity score. Censys data shows over 100,000 Uni

For Security EngineersRead

Incident

4 min read

1.8M Malicious Packages in Six Months

What Happened By the end of Q2 2026, Sonatype Research logged 1.8 million malicious packages across public registries. This wasn t a single sophisticated attack. It was industrial-scale pollution of t

For Security EngineersRead

npm Package Hijack Drains Crypto Wallets

Incident

4 min read

npm Package Hijack Drains Crypto Wallets

On December 20, 2024, attackers compromised the GitHub repository for Injective Labs SDK and published a malicious npm package designed to steal cryptocurrency wallet private keys. The malicious versi

For Security EngineersRead

AI Coding Assistant Hallucinated a Botnet

Incident

4 min read

AI Coding Assistant Hallucinated a Botnet

Your AI coding assistant just suggested a package that doesn t exist. You accept the suggestion. Moments later, malware is running on your machine. This isn t theoretical. Researchers at Tel Aviv Univ

For Security EngineersRead

Langflow IDOR Flaw: When API Authorization Fails

Incident

4 min read

Langflow IDOR Flaw: When API Authorization Fails

What Happened Attackers are actively exploiting CVE-2026-55255 , an Insecure Direct Object Reference (IDOR) vulnerability in Langflow s /api/v1/responses endpoint. This flaw allows anyone to execute w

For Security EngineersRead

AI Agents Tricked Into Running Malware They Were Meant to Catch

Incident

4 min read

AI Agents Tricked Into Running Malware They Were Meant to Catch

Your security tooling just became an attack vector. Researchers have demonstrated a proof-of-concept attack called Friendly Fire that turns AI coding agents into unwitting accomplices. Tools like Anth

For Security EngineersRead

AI Agent Leaked Private Repos Through a GitHub Issue

Incident

4 min read

AI Agent Leaked Private Repos Through a GitHub Issue

What Happened Noma Security discovered GitLost, a prompt injection attack exploiting GitHub s preview Agentic Workflows to leak private repository data. The attack is simple: an attacker submits a cra

For Security EngineersRead

ColdFusion RDS Zero-Day: Exploited in Two Hours

Incident

4 min read

ColdFusion RDS Zero-Day: Exploited in Two Hours

What Happened On June 30, 2026, Adobe released emergency patches for CVE-2026-48282, a path traversal vulnerability in ColdFusion s Remote Development Services (RDS) component. This vulnerability has

For Security EngineersRead

654 Repos Passed Security Scans While Leaking Secrets

Incident

5 min read

654 Repos Passed Security Scans While Leaking Secrets

Your GitHub Actions workflows are green across the board. CodeQL found nothing. Your SAST tool gave you a clean bill of health. You re compliant, right? Not according to Novee Security, which just fla

For Security EngineersRead

GitHub's GitLost: When AI Agents Leak Private Repos

Incident

4 min read

GitHub's GitLost: When AI Agents Leak Private Repos

A public GitHub issue with a cleverly-worded sentence can trick an AI agent into revealing the contents of your private repository. This isn t just theoretical. Researchers at Noma Security demonstrat

For Security EngineersRead

Incident

5 min read

AI Agent Wrote the Vulnerable Code: A Supply Chain Incident You Can't Patch Traditionally

What Happened Your team integrated an AI coding assistant into the CI/CD pipeline to speed up feature delivery. Over three months, the assistant generated about 40% of the production code, including a

For Security EngineersRead

Showing 81-96 of 555 articles

PreviousPage 6 of 35Next