Expert perspectives on application security, compliance, and emerging threats
StandardsYour PHP applications rely on Composer . If you re running versions between 2.0 and 2.2.27 or between 2.3 and 2.9.6, you are exposed to command injection vulnerabilities in your dependency management
StandardsThe compromise of the Axios npm package through social engineering highlights a critical vulnerability in the software supply chain: the security of your dependencies is only as strong as the people w
StandardsOn April 22, 2026, malicious versions of xinference appeared on PyPI, targeting AI inference servers with credential theft payloads that leave no persistent traces. This attack marks a tactical shift:
StandardsScope - What This Guide Covers With NIST reducing its role in CVE data enrichment, your vulnerability management program must adapt. This guide details the changes, their impact, and the necessary adj
Get weekly security insights and compliance updates delivered to your inbox.
StandardsNIST enriched nearly 42,000 CVEs in 2025, a 45% increase over previous years. Yet they just announced they re scaling back. Why? CVE submissions jumped 263% between 2020 and 2025, and the old model of
StandardsI ve been fielding urgent questions about CVE-2026-40478 in Thymeleaf. Many teams using Java Spring apps with Thymeleaf are now facing a 9.1 CVSS vulnerability that allows unauthenticated attackers to
StandardsWhen Socket alerted on malicious Docker images in the official checkmarx/kics repository—including a new tag v2.1.21—and compromised VS Code extensions (checkmarx/ [email protected] and 1.19.0), se
StandardsScope - What This Guide Covers This guide addresses the operational gap between discovering vulnerabilities and fixing them in environments where AI-assisted scanning is common. You ll find frameworks
StandardsOn April 23, 2026, Mend.io discovered a compromised package on npm masquerading as @bitwarden/cli version 2026.4.0. This package combined three attack mechanisms: a self-propagating npm worm, a GitHub
StandardsYour team just deployed an AI agent to automate incident response. It needs to query your SIEM, update tickets, and potentially disable compromised accounts. The question you re facing: how do you gra
StandardsScope - What This Guide Covers This guide provides detection, prevention, and response strategies for supply chain attacks targeting package registries. It includes steps for securing your dependency
StandardsA critical vulnerability with a CVSS score of 9.1 appeared in ASP.NET Core s Data Protection Library—not from a zero-day exploit, but from a Microsoft update. CVE-2026-40372 affects authentication tok
StandardsSocket and StepSecurity detected a supply chain worm in npm packages that doesn t just steal credentials—it spreads itself. The attack, tracked as CanisterSprawl, uses postinstall hooks to exfiltrate
StandardsYour open-source project just received an email from someone claiming to be a core maintainer, asking for elevated repository access. The writing style matches, and the email domain looks legitimate,
StandardsYour team likely relies on the NVD scores to decide what to patch, with automation pulling CVSS data to prioritize remediation. Now, NIST is shifting its focus, having enriched nearly 42,000 CVEs in 2
StandardsScope - What This Guide Covers This guide defines security responsibilities for teams deploying AI systems from third-party vendors. It addresses: Which security controls belong to your team vs. the v
