Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams912 Security Engineers1021 Compliance Teams274 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All912 Incident912 General269 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

912 articles in Incident · Clear filtersSort byNewest·Trending

AsyncAPI Supply-Chain Attack: Four Hours That Exposed 2.25 Million Downloads

Incident

Latest

4 min read

AsyncAPI Supply-Chain Attack: Four Hours That Exposed 2.25 Million Downloads

On July 14, a misconfigured GitHub Actions workflow turned AsyncAPI s npm packages into a distribution channel for credential-stealing malware. The attack lasted just over four hours, but the packages

For DevOps LeadersRead article

AI Found a Zero-Day in WordPress: What Broke

Incident

5 min read

AI Found a Zero-Day in WordPress: What Broke

Intruder s security research team discovered a SQL injection vulnerability in the Creative Mail plugin for WordPress using an automated pipeline that combines traditional code scanning with AI analysi

For Security EngineersRead

Two Joomla Extensions Under Active Attack

Incident

4 min read

Two Joomla Extensions Under Active Attack

CISA issued Emergency Directive 25-01 on January 15, 2025, ordering federal agencies to patch or mitigate two remote code execution vulnerabilities in Joomla extensions within 72 hours. The flaws in i

For Security EngineersRead

SAP Patches Three Critical Flaws: What Went Wrong

Incident

4 min read

SAP Patches Three Critical Flaws: What Went Wrong

What Happened SAP released 16 security patches in July 2026, including three critical vulnerabilities that could let attackers access unauthorized data, crash systems, or trigger denial-of-service con

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Maven Central's CARE Program: What Happens When Nobody's Home

Incident

5 min read

Maven Central's CARE Program: What Happens When Nobody's Home

What Happened Maven Central is tackling a coordination problem. A vulnerability appears in a widely-used library, but the maintainer is unavailable, unresponsive, or has abandoned the project. Your bu

For Compliance TeamsRead

AI Agents Hit Admin in 93% of Runs Until This Defense Worked

Incident

5 min read

AI Agents Hit Admin in 93% of Runs Until This Defense Worked

What Happened Tracebit researchers conducted an experiment that should concern anyone developing AI-powered security tools. They deployed autonomous AI agents in test environments to see how quickly t

For Security EngineersRead

Jscrambler npm Package Backdoored: A Supply Chain Breach Teardown

Incident

4 min read

Jscrambler npm Package Backdoored: A Supply Chain Breach Teardown

On a typical Tuesday, a widely-used JavaScript protection tool became an attack vector. The Jscrambler npm package , trusted by development teams for code obfuscation and security, was compromised wit

For Security EngineersRead

Cursor IDE Executes Malicious Code After Ignored Disclosure

Incident

4 min read

Cursor IDE Executes Malicious Code After Ignored Disclosure

What Happened In December 2024, security researchers disclosed a vulnerability in Cursor, an AI-powered code editor, that allows automatic execution of malicious code when a developer opens a compromi

For Security EngineersRead

35,000 CVEs in Six Months: When Patching Everything Stops Working

Incident

4 min read

35,000 CVEs in Six Months: When Patching Everything Stops Working

The Problem Between January and June 2026, more than 35,000 CVEs were published, averaging one every 7.4 minutes. This surpasses the total vulnerabilities reported in any full year before 2024. Meanwh

For Compliance TeamsRead

99.9% of Fixable AI Vulns Still Unpatched

Incident

4 min read

99.9% of Fixable AI Vulns Still Unpatched

The Problem Orca Security recently found that 99.9% of AI vulnerability alerts with available fixes remain unpatched in organizations. Eighty-one percent of companies using AI have at least one known

For Compliance TeamsRead

400 Scripts, 300 Servers, One GenAI Breach

Incident

4 min read

400 Scripts, 300 Servers, One GenAI Breach

What Happened Attackers used generative AI to create over 400 custom exploitation scripts, compromising more than 300 servers in a single breach. The speed and scale were beyond human capability. This

For Security EngineersRead

Your AI Model Just Hallucinated Customer Data

Incident

5 min read

Your AI Model Just Hallucinated Customer Data

Your compliance team spent six months building an AI risk register. You documented model drift, bias risks, and data poisoning scenarios. You assigned likelihood scores, impact ratings, and risk owner

For Compliance TeamsRead

5 Million Alerts: What Google's AI Agent Numbers Tell Us About Human-Scale Security

Incident

4 min read

5 Million Alerts: What Google's AI Agent Numbers Tell Us About Human-Scale Security

Overview Google Cloud recently introduced AI-powered security agents at Next 26, highlighting that its Triage and Investigation agent processed over 5 million alerts in the past year. Additionally, Go

For Security EngineersRead

Mythos Finds 1,000 Bugs in 10 Hours: Where EPSS Fits In

Incident

4 min read

Mythos Finds 1,000 Bugs in 10 Hours: Where EPSS Fits In

What Happened In October 2024, Anthropic deployed an AI agent called Mythos to scan its codebase. The system identified roughly 1,000 potential vulnerabilities in just 10 hours. For context, that s ab

For Security EngineersRead

Joomla Zero-Days: What Two File Upload Flaws Reveal About CMS Defense

Incident

4 min read

Joomla Zero-Days: What Two File Upload Flaws Reveal About CMS Defense

What Happened Two Joomla extensions, iCagenda and Balbooa Forms, contained critical file upload vulnerabilities that attackers exploited before patches were available. CVE-2026-48939 (iCagenda) and CV

For Security EngineersRead

Cisco Finds Memory Leak in Claude's Prompt Cache

Incident

4 min read

Cisco Finds Memory Leak in Claude's Prompt Cache

What Happened Cisco s security research team discovered a vulnerability in Anthropic s Claude AI system that allowed unauthorized access to cached conversation memories. This flaw let attackers retrie

For Security EngineersRead

Showing 289-304 of 912 articles

PreviousPage 19 of 57Next