Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1439 Security Engineers1020 Compliance Teams274 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All1439 Incident911 General269 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

1439 articlesSort byNewest·Trending

Incident

Latest

4 min read

Backdoored Rust Packages on Crates.io

On August 20, malicious versions of three Rust packages appeared on crates.io . These packages contained backdoors that executed during the build process, before your code ever ran. One of the comprom

For Security EngineersRead article

Incident

4 min read

91 Spring CVEs in One Day: What Broke

On August 20, 2026, Broadcom released 91 CVEs affecting Spring Framework and related projects. Not over a quarter. Not spread across a month. In a single disclosure event. Sonatype s analysis identifi

For Security EngineersRead

Rust Crate Attack: 86 Minutes to Containment

Incident

4 min read

Rust Crate Attack: 86 Minutes to Containment

Recently, malicious code was pushed to three popular Rust crates with a combined 245 million downloads. The Rust Security Response Team removed them 86 to 107 minutes later. Here s what failed, what w

For Security EngineersRead

Rust Crate Attack: How arrayref Fell in 90 Minutes

Incident

4 min read

Rust Crate Attack: How arrayref Fell in 90 Minutes

On August 20, 2024, at 01:17 UTC, attackers compromised the maintainer account for arrayref, a Rust crate with over 53 million downloads in the prior 90 days. Within 90 minutes, they published three m

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

NASA's Spacecraft Tool Had No Auth for 9 Years

Incident

4 min read

NASA's Spacecraft Tool Had No Auth for 9 Years

A web interface that sends commands to spacecraft had no authentication requirement. For nearly a decade, NASA s Advanced Multi-Mission Operations System (AMMOS) Instrument Toolkit Graphical User Inte

For Security EngineersRead

Isolated-vm Sandbox Break: When Your Isolation Library Isn't

Incident

5 min read

Isolated-vm Sandbox Break: When Your Isolation Library Isn't

What Happened A critical vulnerability in isolated-vm , a widely-used Node.js library designed to run untrusted JavaScript in isolated V8 contexts, allowed sandboxed code to escape containment and cor

For Security EngineersRead

Incident

4 min read

Grok Decrypted Its Own Attack Payload

In June 2024, Adversa researchers discovered a significant vulnerability: they could trick Grok into executing malicious instructions by hiding them inside AES-256-GCM encrypted payloads. The AI model

For Security EngineersRead

Elementor Pro RCE: When Your Form Validation Lies

Incident

5 min read

Elementor Pro RCE: When Your Form Validation Lies

On August 3, 2024, Patchstack disclosed CVE-2026-32475 , a remote code execution vulnerability in Elementor Pro s File Upload module. The flaw affected all versions before 4.2.2. Here s what happened

For Security EngineersRead

Critical Type Confusion in isolated-vm Exposes AI Workloads

Incident

4 min read

Critical Type Confusion in isolated-vm Exposes AI Workloads

If you re running untrusted code in a JavaScript sandbox, you need to know about a recent vulnerability in one of the most popular isolation libraries. The isolated-vm package, downloaded over 1 milli

For Security EngineersRead

CISA Adds MLflow SSRF to KEV: What Failed

Incident

4 min read

CISA Adds MLflow SSRF to KEV: What Failed

CISA recently added a critical vulnerability in MLflow to its Known Exploited Vulnerabilities catalog. This flaw allows server-side request forgery (SSRF) attacks, enabling attackers to access interna

For Security EngineersRead

Air-Gapped Systems Don't Need Supply Chain Controls

General

5 min read

Air-Gapped Systems Don't Need Supply Chain Controls

You ve built a fortress. Your most sensitive systems sit behind an air gap, physically isolated from the internet. No inbound connections, no outbound data leaks, no remote attacks. The compliance box

For Compliance TeamsRead

8,000 Accounts Breached Through Academic Spear Phishing

Incident

4 min read

8,000 Accounts Breached Through Academic Spear Phishing

The Mabna Institute, an Iranian cybersecurity firm, compromised around 8,000 accounts by targeting over 100,000 university and research accounts worldwide. This wasn t due to a zero-day exploit or sop

For Security EngineersRead

Spectre Attack Leaked Cloudflare JWT at 12 Bits/Second

Incident

4 min read

Spectre Attack Leaked Cloudflare JWT at 12 Bits/Second

What Happened Researchers executed a Spectre attack against Cloudflare Workers, extracting a JSON Web Token (JWT) from a co-located worker process at 12 bits per second. The attack exploited speculati

For Security EngineersRead

Ray Framework RCE: Anatomy of a DNS Rebinding Attack

Incident

4 min read

Ray Framework RCE: Anatomy of a DNS Rebinding Attack

What Happened Developers using the Ray distributed computing framework locally were targeted by remote code execution attacks via their web browsers. The vulnerability, CVE-2025-62593, exploited Ray s

For Security EngineersRead

Incident

4 min read

AI Missed the Flaw, AI Found the Flaw

On June 18, Snowflake merged PR#1218 into their GitHub Actions pipeline. This pull request contained a vulnerability that exposed internal Jira credentials. During development, GitHub Copilot reviewed

For Security EngineersRead

AI Accelerated Your Codebase Into a Compliance Failure

Incident

4 min read

AI Accelerated Your Codebase Into a Compliance Failure

What Happened Between January and December 2024, software development teams using AI-assisted coding tools saw a significant shift. They reduced their median vulnerability age by 59%. Teams triaged fa

For Security EngineersRead

Showing 161-176 of 1439 articles

PreviousPage 11 of 90Next