Expert perspectives on application security, compliance, and emerging threats
IncidentThe Problem A scan of the top 5,000 websites using WebPageTest and the Snyk vulnerability database found that 76.6% include at least one JavaScript library with a known vulnerability. The most common
IncidentWhat Happened On February 13th, a high-severity prototype override protection bypass vulnerability was discovered in the qs npm package . This package, which parses query strings, recorded nearly 40 m
IncidentWhat Happened On September 7, 2017, Equifax disclosed a breach affecting 143 million people. The attack exploited a vulnerability in Apache Struts , a widely-used open-source web application framework
IncidentWhat Happened The marked package, a popular Markdown parser with over 10 million weekly downloads on npm, shipped with its sanitize option turned off by default. This choice exposed applications proce
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOverview of the Vulnerability Multiple severe vulnerabilities in ImageMagick have been disclosed and are being actively exploited. The imagemagick npm package , which integrates ImageMagick for Node.j
IncidentOn January 11th, the Snyk security research team disclosed XML External Entity (XXE) vulnerabilities in Nokogiri, a widely-used Ruby XML parsing library. Versions prior to 1.5.4 were vulnerable by def
DeadlinesYour team just deployed AI agents to production. They re running on Amazon Bedrock, calling internal APIs, reading configuration files, and making autonomous decisions. When your CISO asks, How do you
ResearchThese myths persist because they allow teams to avoid uncomfortable conversations about accountability. When your auditor asks who owns security for the 247 open source packages in your application, p
IncidentUnderstanding the Vulnerability Snyk s security team has disclosed a path traversal vulnerability affecting archive extraction libraries across multiple ecosystems. Known as Zip Slip, this vulnerabili
IncidentOn March 15, 2025, security researchers detected active exploitation of CVE-2026-33017, a critical remote code execution vulnerability in Langflow, a popular low-code framework for building AI workflo
IncidentOn November 26, 2018, security researchers discovered that event-stream —a widely-used npm package downloaded roughly 2 million times per week—had been compromised. The malicious code, hidden in a dep
IncidentWhat Happened In early 2018, Snyk s security research team discovered a directory traversal vulnerability in archive extraction code affecting thousands of projects across multiple ecosystems. The vul
GeneralWhen you review a Pull Request, you re looking at changed files. Your SAST tool scans those files. Your IDE highlights issues in the file you have open. But the SQL injection vulnerability? It starts
GeneralThe Conventional Wisdom Your security team runs dependency scanners in CI/CD. You ve configured Dependabot, Snyk, or another tool. When a pull request comes in, the scanner checks for known vulnerabil
IncidentWhat Happened Between 2016 and 2017, the number of published vulnerabilities across tracked open-source ecosystems jumped 83 percent. The npm and Maven Central repositories — essential for JavaScript
IncidentWhat Happened In September 2018, the maintainer of event-stream —an npm package downloaded 2 million times per week—transferred ownership to a new contributor after months of social engineering. Withi
