Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams707 Security Engineers759 Compliance Teams223 DevOps Leaders63 Developers31 CISOs17 IT Directors2

Topics:All707 Incident707 General188 Standards88 Research61 Guides34 Deadlines11 Vendor News4 Legal2

707 articles in Incident · Clear filtersSort byNewest·Trending

Log4Shell: 60% of Java Projects Failed Before the Breach

Incident

Latest

4 min read

Log4Shell: 60% of Java Projects Failed Before the Breach

What Happened On December 9, 2021, security researchers disclosed CVE-2021-44228 , a remote code execution vulnerability in Apache Log4j 2. Known as Log4Shell, it received a CVSS score of 10, indicati

For Security EngineersRead article

Log4Shell: How a Logging Library Became a 10.0 CVSS Nightmare

Incident

4 min read

Log4Shell: How a Logging Library Became a 10.0 CVSS Nightmare

What Happened On December 10, 2021, a critical remote code execution vulnerability in Apache Log4j, identified as CVE-2021-44228, received a CVSS score of 10—the highest severity rating. Known as Log4

For Security EngineersRead

FTC Tells Companies: Fix Log4j or Face Legal Action

Incident

4 min read

FTC Tells Companies: Fix Log4j or Face Legal Action

What Happened The Federal Trade Commission (FTC) issued a public warning to companies: if you fail to protect consumer data from exposure due to Log4j vulnerabilities, they will pursue legal action. T

For Compliance TeamsRead

One Maintainer Broke 95,000 Builds in a Week

Incident

4 min read

One Maintainer Broke 95,000 Builds in a Week

On January 9, 2022, developers worldwide faced a sudden disruption: their builds were broken. This wasn t due to a zero-day exploit or a sophisticated supply chain attack, but rather a maintainer inte

For Compliance TeamsRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

CVE-2021-44832: A Disclosure Failure Teardown

Incident

4 min read

CVE-2021-44832: A Disclosure Failure Teardown

On December 28, 2021, the Apache Log4j team released version 2.17.1 to patch CVE-2021-44832, a remote code execution vulnerability with a CVSS score of 6.6. The technical details are less critical tha

For Security EngineersRead

Log4Shell: The Dependency You Didn't Know You Had

Incident

3 min read

Log4Shell: The Dependency You Didn't Know You Had

What Happened On December 10, 2021, the Apache Log4j team disclosed CVE-2021-44832 , a remote code execution vulnerability in a widely used Java logging library. Attackers could exploit this by sendin

For Security EngineersRead

Incident

4 min read

Log4j 2.16 DoS: When a Patch Becomes an Incident

What Happened On December 18, 2021, Apache disclosed CVE-2021-45105 , a high-severity Denial of Service vulnerability in Log4j version 2.16 — the version released just days earlier to fix CVE-2021-450

For Security EngineersRead

Incident

4 min read

Log4j 2.15 Fell in 72 Hours

What Happened On December 14, 2021, Apache released Log4j version 2.15.0 to address CVE-2021-44228 , the Log4Shell vulnerability. Security teams worldwide rushed to deploy the patch. However, three da

For Security EngineersRead

Log4Shell: How a Logging Library Became CVE-2021-44228

Incident

4 min read

Log4Shell: How a Logging Library Became CVE-2021-44228

What Happened In December 2021, a critical vulnerability in Apache Log4j—a widely used Java logging library—allowed attackers to execute arbitrary code on vulnerable systems. This exploit, known as CV

For Compliance TeamsRead

AI Agent Runs Malicious Code from Error Logs

Incident

5 min read

AI Agent Runs Malicious Code from Error Logs

What Happened Tenet Security discovered a new attack pattern called Agentjacking that weaponizes AI coding agents against their own development teams. The attack works by injecting malicious code into

For Security EngineersRead

When the AI Agent You Built Stops Working

Incident

4 min read

When the AI Agent You Built Stops Working

You developed an AI security agent in just three days. It scanned your repositories, flagged secrets, and impressed your VP. Two months later, it s generating 400 false positives per day, and your tea

For Security EngineersRead

phpBB's Ten-Year Auth Bypass: A Teardown

Incident

4 min read

phpBB's Ten-Year Auth Bypass: A Teardown

An authentication bypass vulnerability lingered in phpBB s codebase for a decade, allowing admin access through a specially crafted request. Aikido discovered the flaw on June 2nd, and phpBB released

For Security EngineersRead

Log4Shell: When a Logging Library Became an RCE Vector

Incident

5 min read

Log4Shell: When a Logging Library Became an RCE Vector

What Happened On December 9, 2021, security researchers disclosed CVE-2021-44228 , a critical remote code execution vulnerability in Log4j2, a widely used Java logging framework maintained by the Apac

For Security EngineersRead

3,000 Stolen GitHub Tokens Found on Dark Forums

Incident

4 min read

3,000 Stolen GitHub Tokens Found on Dark Forums

What Happened Flare researchers discovered active listings for compromised developer credentials and access tokens on underground forums—weeks before these same credentials appeared in public supply-c

For Security EngineersRead

Argo CD Zero-Day: When CD Platforms Become the Attack Vector

Incident

4 min read

Argo CD Zero-Day: When CD Platforms Become the Attack Vector

What Happened On January 18, 2022, security researchers disclosed CVE-2022-24348 , a directory/path traversal vulnerability in Argo CD, a continuous delivery platform used to automate Kubernetes deplo

For DevOps LeadersRead

Incident

5 min read

AI Agent Hijacked on Live Demo Platform

What Happened A security evaluation using the StakeBench benchmark revealed that current AI web agents are vulnerable to prompt injection attacks across various deployment scenarios. Researchers teste

For Security EngineersRead

Showing 273-288 of 707 articles

PreviousPage 18 of 45Next