Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams298 Security Engineers149 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All298 Incident149 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

298 articlesSort byNewest·Trending

766 Hosts Compromised in 24 Hours: The React2Shell Credential Theft Campaign

Incident

Latest

4 min read

766 Hosts Compromised in 24 Hours: The React2Shell Credential Theft Campaign

What Happened Between late 2024 and early 2025, attackers exploited the React2Shell vulnerability in Next.js applications to execute an automated credential theft campaign. Using a framework called NE

For Security EngineersRead article

Security Fix Exists, But Your Users Are Still Vulnerable

Incident

4 min read

Security Fix Exists, But Your Users Are Still Vulnerable

What Happened Adversa discovered a vulnerability in Claude Code that allows attackers to bypass security controls by submitting more than 50 subcommands in a single request. When the system encounters

For Compliance TeamsRead

npm's Axios Package Delivered Cross-Platform RAT Through Compromised Maintainer Account

Standards

5 min read

npm's Axios Package Delivered Cross-Platform RAT Through Compromised Maintainer Account

A compromised maintainer account on npm deployed a cross-platform Remote Access Trojan (RAT) through malicious versions of Axios, a widely used JavaScript HTTP client library. If your systems ran npm

For Security EngineersRead

The Pre-Commit Secrets Policy Your Developers Will Actually Use

Standards

6 min read

The Pre-Commit Secrets Policy Your Developers Will Actually Use

Your team committed 29 million new hardcoded secrets to public repositories in 2025—a 34% increase from the previous year. AI services contributed to 81% more leaks year over year, and internal reposi

For CISOsRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Should You Lock Down Your Package Repository or Monitor It?

Standards

5 min read

Should You Lock Down Your Package Repository or Monitor It?

The Telnyx SDK compromise on PyPI presents your security team with a critical decision: do you restrict package installation at the perimeter, or do you allow flexibility and invest in runtime detecti

For Compliance TeamsRead

A Security Scanner Becomes the Attack Vector: The Trivy Supply Chain Breach

Incident

4 min read

A Security Scanner Becomes the Attack Vector: The Trivy Supply Chain Breach

On March 19, 2026, TeamPCP compromised Aqua Security s Trivy vulnerability scanner—a tool millions of developers rely on to find security flaws. The attackers didn t exploit a zero-day in the scanner

For Compliance TeamsRead

56% of Vulnerable Magento Stores Hit Within 10 Days

Incident

5 min read

56% of Vulnerable Magento Stores Hit Within 10 Days

What Happened Mass exploitation of the PolyShell vulnerability in Magento Open Source and Adobe Commerce began on March 19th. Within days, attackers compromised 56.7% of all vulnerable stores. The att

For Compliance TeamsRead

4,000 Downloads of Malicious Code: The Cline npm Package Compromise

Incident

4 min read

4,000 Downloads of Malicious Code: The Cline npm Package Compromise

What Happened The npm package Cline version 2.3.0 was compromised with malicious code that installed OpenClaw, a backdoor tool, on developer machines. This version was downloaded over 4,000 times befo

For Security EngineersRead

AI-Generated Malware in Your Dependencies: Detection Checklist

Standards

5 min read

AI-Generated Malware in Your Dependencies: Detection Checklist

A recent campaign distributing over 300 poisoned packages shows how attackers now use AI to scale supply chain attacks. Your dependency scanning probably caught the known signatures, but it won t catc

For Security EngineersRead

Authentication Bypass in pac4j-jwt Exposes Java Applications

Incident

5 min read

Authentication Bypass in pac4j-jwt Exposes Java Applications

What Happened CVE-2026-29000, a critical authentication bypass vulnerability in the pac4j-jwt library, allows attackers to bypass authentication controls in Java applications. The flaw was identified

For Security EngineersRead

AI Agent Turned Exfiltration Tool: The PleaseFix Vulnerability

Incident

5 min read

AI Agent Turned Exfiltration Tool: The PleaseFix Vulnerability

Your AI browser agent just accessed your local file system, read your credentials, and sent them to an attacker. You didn t click anything. You didn t approve any action. The agent did it autonomously

For Security EngineersRead

1,000 SaaS Environments Compromised Through a Security Scanner

Incident

4 min read

1,000 SaaS Environments Compromised Through a Security Scanner

What Happened Between late 2024 and early 2025, attackers compromised the Trivy vulnerability scanner s supply chain by stealing npm publish tokens. They backdoored more than 29 packages that Trivy de

For Compliance TeamsRead

15,000 Magento Stores Hit by Defacement: PolyShell Vulnerability Teardown

Incident

4 min read

15,000 Magento Stores Hit by Defacement: PolyShell Vulnerability Teardown

What Happened Security researchers at Sansec discovered a critical vulnerability in Magento s REST API, designated PolyShell, that allows attackers to upload malicious files to e-commerce sites withou

For Compliance TeamsRead

AI Component Inventory Template: Mapping Your LLM Dependencies in 72 Hours

Standards

6 min read

AI Component Inventory Template: Mapping Your LLM Dependencies in 72 Hours

The Pentagon s 180-day deadline to remove Anthropic technology exposes a fundamental gap: most organizations cannot precisely answer, where do we use AI? Only 31% of organizations report being fully e

For CISOsRead

"Wait, this package is suddenly asking for what permissions?"

Standards

5 min read

"Wait, this package is suddenly asking for what permissions?"

These questions started showing up in security Slack channels right after StepSecurity flagged two hijacked npm packages in the React Native ecosystem. These packages, with over 30,000 downloads per w

For Security EngineersRead

Securing Your Dependency Chain Against Malicious Extensions

Research

5 min read

Securing Your Dependency Chain Against Malicious Extensions

Your build pulls in 847 dependencies. One of them just downloaded your AWS credentials. Researchers have identified dozens of malicious GlassWorm extensions in the wild, each iteration more sophistica

For Security EngineersRead

Showing 145-160 of 298 articles

PreviousPage 10 of 19Next