Expert perspectives on application security, compliance, and emerging threats
StandardsWhen Socket alerted on malicious Docker images in the official checkmarx/kics repository—including a new tag v2.1.21—and compromised VS Code extensions (checkmarx/ [email protected] and 1.19.0), se
StandardsScope - What This Guide Covers This guide addresses the operational gap between discovering vulnerabilities and fixing them in environments where AI-assisted scanning is common. You ll find frameworks
StandardsOn April 23, 2026, Mend.io discovered a compromised package on npm masquerading as @bitwarden/cli version 2026.4.0. This package combined three attack mechanisms: a self-propagating npm worm, a GitHub
StandardsYour team just deployed an AI agent to automate incident response. It needs to query your SIEM, update tickets, and potentially disable compromised accounts. The question you re facing: how do you gra
Get weekly security insights and compliance updates delivered to your inbox.
StandardsScope - What This Guide Covers This guide provides detection, prevention, and response strategies for supply chain attacks targeting package registries. It includes steps for securing your dependency
StandardsA critical vulnerability with a CVSS score of 9.1 appeared in ASP.NET Core s Data Protection Library—not from a zero-day exploit, but from a Microsoft update. CVE-2026-40372 affects authentication tok
StandardsSocket and StepSecurity detected a supply chain worm in npm packages that doesn t just steal credentials—it spreads itself. The attack, tracked as CanisterSprawl, uses postinstall hooks to exfiltrate
StandardsYour open-source project just received an email from someone claiming to be a core maintainer, asking for elevated repository access. The writing style matches, and the email domain looks legitimate,
StandardsYour team likely relies on the NVD scores to decide what to patch, with automation pulling CVSS data to prioritize remediation. Now, NIST is shifting its focus, having enriched nearly 42,000 CVEs in 2
StandardsScope - What This Guide Covers This guide defines security responsibilities for teams deploying AI systems from third-party vendors. It addresses: Which security controls belong to your team vs. the v
StandardsYou ve seen the reports. NIST has changed the way it prioritizes software flaws in its CVE framework. The shift is clear: focus on high-impact vulnerabilities, not just volume. This isn t about abando
StandardsThe Challenge Between 2020 and 2023, CVE submissions grew 263%. Last year alone, NIST enriched almost 42,000 CVEs—a 45% year-over-year increase. Then NIST announced it would no longer analyze every vu
StandardsOver the past month, I ve encountered the same set of questions in multiple forums, all centering on Anthropic s Claude Mythos—an AI model that claims to find and weaponize vulnerabilities at an unpre
StandardsA remote code execution vulnerability in protobuf.js (GHSA-xq3m-2v4x-88gg) affecting versions 8.0.0/7.5.4 and lower allows attackers to inject malicious code through unsafe dynamic code generation. If
StandardsCVE-2026-34040 scored 8.8 on the CVSS scale. It s a regression of vulnerabilities patched in 2019 and 2024. The fix is available in Docker Engine 29.3.1 and Docker Desktop 4.66.1. The real question is
StandardsYour vulnerability management program is about to undergo a significant transformation. AI models that autonomously discover vulnerabilities at scale are now production tools. Your team needs a deploy
