Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams81 Security Engineers142 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All81 Incident142 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

81 articles in Standards · Clear filtersSort byNewest·Trending

Maintainer Impersonation Response Script for Open-Source Projects

Standards

Latest

4 min read

Maintainer Impersonation Response Script for Open-Source Projects

Your open-source project just received an email from someone claiming to be a core maintainer, asking for elevated repository access. The writing style matches, and the email domain looks legitimate,

For Compliance TeamsRead article

"We're drowning in CVEs" — What NIST's triage shift means for your vulnerability program

Standards

4 min read

"We're drowning in CVEs" — What NIST's triage shift means for your vulnerability program

Your team likely relies on the NVD scores to decide what to patch, with automation pulling CVSS data to prioritize remediation. Now, NIST is shifting its focus, having enriched nearly 42,000 CVEs in 2

For Security EngineersRead

Mapping Security Accountability Across the AI Stack

Standards

5 min read

Mapping Security Accountability Across the AI Stack

Scope - What This Guide Covers This guide defines security responsibilities for teams deploying AI systems from third-party vendors. It addresses: Which security controls belong to your team vs. the v

For Compliance TeamsRead

Stop Patching Every CVE: A Checklist for Impact-Based Vulnerability Management

Standards

5 min read

Stop Patching Every CVE: A Checklist for Impact-Based Vulnerability Management

You ve seen the reports. NIST has changed the way it prioritizes software flaws in its CVE framework. The shift is clear: focus on high-impact vulnerabilities, not just volume. This isn t about abando

For Compliance TeamsRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

NIST Just Handed You the CVE Problem—Here's What Happened Next

Standards

5 min read

NIST Just Handed You the CVE Problem—Here's What Happened Next

The Challenge Between 2020 and 2023, CVE submissions grew 263%. Last year alone, NIST enriched almost 42,000 CVEs—a 45% year-over-year increase. Then NIST announced it would no longer analyze every vu

For Security EngineersRead

What We're Learning About AI Vulnerability Scanners (And What We're Not)

Standards

5 min read

What We're Learning About AI Vulnerability Scanners (And What We're Not)

Over the past month, I ve encountered the same set of questions in multiple forums, all centering on Anthropic s Claude Mythos—an AI model that claims to find and weaponize vulnerabilities at an unpre

For Compliance TeamsRead

Patching the protobuf.js RCE Vulnerability: A Step-by-Step Response Plan

Standards

4 min read

Patching the protobuf.js RCE Vulnerability: A Step-by-Step Response Plan

A remote code execution vulnerability in protobuf.js (GHSA-xq3m-2v4x-88gg) affecting versions 8.0.0/7.5.4 and lower allows attackers to inject malicious code through unsafe dynamic code generation. If

For DevelopersRead

Docker AuthZ Bypass: Which Plugin Architecture Should You Deploy?

Standards

5 min read

Docker AuthZ Bypass: Which Plugin Architecture Should You Deploy?

CVE-2026-34040 scored 8.8 on the CVSS scale. It s a regression of vulnerabilities patched in 2019 and 2024. The fix is available in Docker Engine 29.3.1 and Docker Desktop 4.66.1. The real question is

For DevOps LeadersRead

Integrating AI Vulnerability Scanners Into Your Security Pipeline

Standards

4 min read

Integrating AI Vulnerability Scanners Into Your Security Pipeline

Your vulnerability management program is about to undergo a significant transformation. AI models that autonomously discover vulnerabilities at scale are now production tools. Your team needs a deploy

For Security EngineersRead

Audio Steganography in Package Attacks: Detection and Response Guide

Standards

4 min read

Audio Steganography in Package Attacks: Detection and Response Guide

Scope This guide focuses on detecting and mitigating supply chain attacks that use audio steganography to hide malicious payloads in software packages. Our case study is the March 27, 2026 compromise

For Security EngineersRead

npm's Axios Package Delivered Cross-Platform RAT Through Compromised Maintainer Account

Standards

5 min read

npm's Axios Package Delivered Cross-Platform RAT Through Compromised Maintainer Account

A compromised maintainer account on npm deployed a cross-platform Remote Access Trojan (RAT) through malicious versions of Axios, a widely used JavaScript HTTP client library. If your systems ran npm

For Security EngineersRead

The Pre-Commit Secrets Policy Your Developers Will Actually Use

Standards

6 min read

The Pre-Commit Secrets Policy Your Developers Will Actually Use

Your team committed 29 million new hardcoded secrets to public repositories in 2025—a 34% increase from the previous year. AI services contributed to 81% more leaks year over year, and internal reposi

For CISOsRead

Should You Lock Down Your Package Repository or Monitor It?

Standards

5 min read

Should You Lock Down Your Package Repository or Monitor It?

The Telnyx SDK compromise on PyPI presents your security team with a critical decision: do you restrict package installation at the perimeter, or do you allow flexibility and invest in runtime detecti

For Compliance TeamsRead

AI-Generated Malware in Your Dependencies: Detection Checklist

Standards

5 min read

AI-Generated Malware in Your Dependencies: Detection Checklist

A recent campaign distributing over 300 poisoned packages shows how attackers now use AI to scale supply chain attacks. Your dependency scanning probably caught the known signatures, but it won t catc

For Security EngineersRead

AI Component Inventory Template: Mapping Your LLM Dependencies in 72 Hours

Standards

6 min read

AI Component Inventory Template: Mapping Your LLM Dependencies in 72 Hours

The Pentagon s 180-day deadline to remove Anthropic technology exposes a fundamental gap: most organizations cannot precisely answer, where do we use AI? Only 31% of organizations report being fully e

For CISOsRead

"Wait, this package is suddenly asking for what permissions?"

Standards

5 min read

"Wait, this package is suddenly asking for what permissions?"

These questions started showing up in security Slack channels right after StepSecurity flagged two hijacked npm packages in the React Native ecosystem. These packages, with over 30,000 downloads per w

For Security EngineersRead

Showing 17-32 of 81 articles

PreviousPage 2 of 6Next