Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened A software supply chain compromise occurred when your team integrated what appeared to be a clean open-source dependency. The package showed zero CVEs in your security scanning tools. Th
IncidentA research team at the University of Missouri-Kansas City has published proof-of-concept code for an attack that bypasses AI code review tools by hiding malicious instructions inside PNG files attache
IncidentWhat Happened On July 8, 2026, a threat actor published version 1.20.21 of @injectivelabs/sdk-ts to npm. The package contained code to steal cryptocurrency wallet private keys. Within 24 hours, the at
IncidentOn January 14, 2025, security researcher Michael Clark confirmed what Sysdig had already detected: attackers were exploiting CVE-2026-20896 to bypass authentication in Gitea Docker deployments. This v
Get weekly security insights and compliance updates delivered to your inbox.
ResearchUnderstanding the Concerns Recently, I ve observed heated debates among security engineers about whether to restrict GitHub Copilot in their environments. The discussions often lack concrete data on h
IncidentUbiquiti recently released security updates for UniFi OS, addressing seven critical vulnerabilities. One of these, CVE-2026-50746, has a maximum CVSS severity score. Censys data shows over 100,000 Uni
IncidentWhat Happened By the end of Q2 2026, Sonatype Research logged 1.8 million malicious packages across public registries. This wasn t a single sophisticated attack. It was industrial-scale pollution of t
GeneralYour vendor just sent you an SBOM. You need to know if it s actually useful or just compliance theater. CISA updated their SBOM guidance to require information for all components with no minimum depth
IncidentOn December 20, 2024, attackers compromised the GitHub repository for Injective Labs SDK and published a malicious npm package designed to steal cryptocurrency wallet private keys. The malicious versi
GeneralYour build broke this morning. Not because of a bug or a failed test, but because npm 12 now requires your explicit permission to run install scripts in your dependency tree. Welcome to the new defaul
IncidentYour AI coding assistant just suggested a package that doesn t exist. You accept the suggestion. Moments later, malware is running on your machine. This isn t theoretical. Researchers at Tel Aviv Univ
IncidentWhat Happened Attackers are actively exploiting CVE-2026-55255 , an Insecure Direct Object Reference (IDOR) vulnerability in Langflow s /api/v1/responses endpoint. This flaw allows anyone to execute w
ResearchYour security scanning tool flags a malicious commit. You block it by hash. Two hours later, the same code appears under a different hash with GitHub s green Verified checkmark intact. The signature d
IncidentYour security tooling just became an attack vector. Researchers have demonstrated a proof-of-concept attack called Friendly Fire that turns AI coding agents into unwitting accomplices. Tools like Anth
IncidentWhat Happened Noma Security discovered GitLost, a prompt injection attack exploiting GitHub s preview Agentic Workflows to leak private repository data. The attack is simple: an attacker submits a cra
GeneralScope This guide covers how to detect, prevent, and respond to malicious packages targeting payment integration SDKs on npm and PyPI . You ll find steps for validating package authenticity, monitoring
