Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams707 Security Engineers759 Compliance Teams223 DevOps Leaders63 Developers31 CISOs17 IT Directors2

Topics:All707 Incident707 General188 Standards88 Research61 Guides34 Deadlines11 Vendor News4 Legal2

707 articles in Incident · Clear filtersSort byNewest·Trending

Spring4Shell: What Failed and How to Fix It

Incident

Latest

4 min read

Spring4Shell: What Failed and How to Fix It

On March 30, 2022, researchers disclosed CVE-2022-22965, a critical remote code execution vulnerability in the Spring Framework. Within hours, proof-of-concept exploits circulated publicly. If your te

For Compliance TeamsRead article

Gogs Zero-Day: When Default Settings Became an RCE Vector

Incident

4 min read

Gogs Zero-Day: When Default Settings Became an RCE Vector

What Happened On June 7, 2024, Gogs maintainers released version 0.14.3 to patch a critical zero-day vulnerability that allowed authenticated attackers to execute remote code on affected servers. The

For Security EngineersRead

Spring4Shell Resurfaces on Glassfish and Payara

Incident

5 min read

Spring4Shell Resurfaces on Glassfish and Payara

What Happened In March 2022, security researchers disclosed CVE-2022-22965 (Spring4Shell), a remote code execution vulnerability in the Spring Framework s parameter binding mechanism. Organizations pa

For Security EngineersRead

50 Million Weekly Downloads, One Prototype Pollution Bug

Incident

4 min read

50 Million Weekly Downloads, One Prototype Pollution Bug

What Happened In early 2025, security researchers at Cyera disclosed multiple vulnerabilities in protobuf.js, the JavaScript implementation of Google s Protocol Buffers serialization library. The most

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Incident

4 min read

37 PyPI Packages Poisoned: What Failed

Between late 2024 and early 2025, attackers compromised 37 wheel distributions and 19 source packages on the Python Package Index (PyPI) . This campaign, known as Hades, represents a tactical evolutio

For Security EngineersRead

19 PyPI Packages Trojanized: The Shai-Hulud Breakdown

Incident

5 min read

19 PyPI Packages Trojanized: The Shai-Hulud Breakdown

What Happened Socket discovered 19 compromised packages on PyPI, downloaded hundreds of thousands of times, delivering malware designed to steal developer credentials. These packages targeted scientif

For DevOps LeadersRead

Incident

4 min read

VS Code Extension Hijack: No Incident Yet, But the Timer Is Running

What Happened Microsoft has introduced a two-hour automatic update delay for Visual Studio Code extensions to mitigate supply chain attack risks. This delay applies to all third-party extensions excep

For Security EngineersRead

Malicious npm Package Targeted Private Registry

Incident

4 min read

Malicious npm Package Targeted Private Registry

On May 1, 2022, npm removed a malicious package called gxm-reference-web-auth-server from the public registry. This targeted attack used encryption and multi-stage obfuscation to hide data exfiltratio

For Security EngineersRead

12 PyPI Packages Stole Discord Credentials via CDN

Incident

4 min read

12 PyPI Packages Stole Discord Credentials via CDN

Snyk discovered 12 malicious packages in the Python Package Index (PyPI) that stole Discord tokens, Roblox credentials, and payment card data. The attackers used Discord s content delivery network (CD

For Security EngineersRead

200+ Malicious npm Packages: What Went Wrong

Incident

4 min read

200+ Malicious npm Packages: What Went Wrong

What Happened Snyk s security research team discovered over 200 malicious packages in the npm registry, exploiting dependency confusion attacks to deliver Cobalt Strike payloads. These packages used i

For Security EngineersRead

Apache Commons Config RCE: When Interpolation Became Exploitation

Incident

4 min read

Apache Commons Config RCE: When Interpolation Became Exploitation

What Happened CVE-2022-33980 allowed attackers to execute arbitrary code through Apache Commons Configuration s string interpolation feature. The vulnerability affected versions 2.4 through 2.7 and st

For Security EngineersRead

Everest Forms Pro Takeover: 29,300 Attacks in 48 Hours

Incident

4 min read

Everest Forms Pro Takeover: 29,300 Attacks in 48 Hours

What Happened Between April 13 and April 15, attackers exploited CVE-2026-3300 , a critical vulnerability in the Everest Forms Pro WordPress plugin, to create rogue administrator accounts on vulnerabl

For Security EngineersRead

Malicious Gem Installed via Pull Request

Incident

4 min read

Malicious Gem Installed via Pull Request

A developer on your team merges a routine dependency update. The diff shows a few version bumps in Gemfile.lock . Your CI passes. The code deploys. Three days later, your build server is mining crypto

For Security EngineersRead

73 Microsoft Repos Infected: Miasma Worm Teardown

Incident

4 min read

73 Microsoft Repos Infected: Miasma Worm Teardown

What Happened In mid-2026, the Miasma worm—a variant of Mini Shai-Hulud—compromised 73 Microsoft GitHub repositories. This attack didn t exploit a traditional vulnerability but instead manipulated the

For Security EngineersRead

Your Scanner Just Became the Attack Vector

Incident

4 min read

Your Scanner Just Became the Attack Vector

What Happened On September 29, 2022, Snyk disclosed CVE-2022-40764, a command injection vulnerability in their CLI tool that allowed arbitrary code execution. This flaw affected all versions before 1.

For Security EngineersRead

ChatGPT Prompt Injection: No Breach Required

Incident

4 min read

ChatGPT Prompt Injection: No Breach Required

What Happened OpenAI didn t suffer a data breach. Instead, they acknowledged a fundamental architectural risk: ChatGPT s features create multiple pathways for prompt injection attacks to exfiltrate da

For Security EngineersRead

Showing 321-336 of 707 articles

PreviousPage 21 of 45Next