Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened A financial services company with 2,800 employees spent 18 months feeding vulnerability data into their exposure management platform. Their dashboard showed 847 critical findings. The se
IncidentWhat Happened Capital One s AI Foundations group developed a reinforcement learning system to identify effective jailbreak techniques against large language models. They tested it using the WildJailbr
IncidentInconsistent Results from LLM Security Reviews Snyk conducted 250 identical security reviews using Claude on the same JavaScript codebase. The outcome was startling: 80 of 161 unique findings appeared
IncidentA Wake Forest University research team analyzed 444 iOS apps with LLM features and found 282 exposing exploitable credentials. These were plaintext API keys and authentication tokens visible in networ
Get weekly security insights and compliance updates delivered to your inbox.
IncidentThe Problem Between 2023 and 2024, HTTP Archive analyzed 418,112 websites using Google Chrome s Lighthouse auditing tool. The findings revealed that 77% of these sites serve at least one JavaScript li
IncidentWhat Happened On November 27th, security researchers disclosed a high-severity Remote Code Execution vulnerability in EJS, a widely-used JavaScript templating engine. This vulnerability allowed attack
IncidentBetween late 2025 and April 11, 2026, North Korean threat actors published 108 malicious packages and extensions across npm, PyPI, Chrome Web Store, and other platforms as part of the PolinRider campa
IncidentThe Problem A scan of the top 5,000 websites using WebPageTest and the Snyk vulnerability database found that 76.6% include at least one JavaScript library with a known vulnerability. The most common
IncidentWhat Happened On February 13th, a high-severity prototype override protection bypass vulnerability was discovered in the qs npm package . This package, which parses query strings, recorded nearly 40 m
IncidentWhat Happened On September 7, 2017, Equifax disclosed a breach affecting 143 million people. The attack exploited a vulnerability in Apache Struts , a widely-used open-source web application framework
IncidentWhat Happened The marked package, a popular Markdown parser with over 10 million weekly downloads on npm, shipped with its sanitize option turned off by default. This choice exposed applications proce
IncidentOverview of the Vulnerability Multiple severe vulnerabilities in ImageMagick have been disclosed and are being actively exploited. The imagemagick npm package , which integrates ImageMagick for Node.j
IncidentOn January 11th, the Snyk security research team disclosed XML External Entity (XXE) vulnerabilities in Nokogiri, a widely-used Ruby XML parsing library. Versions prior to 1.5.4 were vulnerable by def
IncidentUnderstanding the Vulnerability Snyk s security team has disclosed a path traversal vulnerability affecting archive extraction libraries across multiple ecosystems. Known as Zip Slip, this vulnerabili
IncidentOn March 15, 2025, security researchers detected active exploitation of CVE-2026-33017, a critical remote code execution vulnerability in Langflow, a popular low-code framework for building AI workflo
IncidentOn November 26, 2018, security researchers discovered that event-stream —a widely-used npm package downloaded roughly 2 million times per week—had been compromised. The malicious code, hidden in a dep
