Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened On February 20, 2020, CNVD published details of CVE-2020-1938—a vulnerability affecting Apache Tomcat versions 6 through 9. Discovered by Chaitin Tech on January 3rd, the flaw exploited
GeneralScope - What This Guide Covers This guide addresses dependency confusion and typo-squatting attacks targeting Python package installations. You ll find concrete verification steps, tooling recommendat
GeneralWhat Changed Asymptote Labs has released Agent Beacon under the MIT license—an open-source telemetry layer that collects and normalizes activity data from AI coding agents across local endpoints, CI p
IncidentWhat Happened A denial of service vulnerability was present in urllib3 , a widely-used Python HTTP library, between versions 1.25.2 and 1.25.8. This flaw allowed attackers to exhaust resources through
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened On June 2, 2020, security researcher Robert McLaughlin discovered a Regular Expression Denial-of-Service (ReDoS) vulnerability in the websocket-extensions package using an automated tool
ResearchWhen mobile teams discovered that a seemingly legitimate advertising SDK was doing more than displaying ads, they faced serious security challenges. Snyk found that the Mintegral SDK included method s
IncidentWhat Happened On March 27, 2020, Danny Thomas disclosed CVE-2020-7599 , a vulnerability in Gradle s plugin-publish plugin that exposed pre-signed AWS URLs in log output. Every version below 0.11.0 was
GeneralOn April 25, 2020, a single-line change in is-promise version 2.2.0 disrupted build pipelines across 12,000,000 weekly downloads. The maintainer fixed it three hours later, but the incident highlighte
IncidentWhat Happened The Snyk Research Team discovered an arbitrary code execution vulnerability in Grunt, a widely-used JavaScript task runner that automates development tasks. The vulnerability, CVE-2020-7
IncidentWhat Happened In 2020, security researcher po6ix discovered a prototype pollution vulnerability in express-fileupload, a Node.js package for handling file uploads. Snyk confirmed the finding and assig
IncidentWhat happened On March 11th, 2020, Snyk disclosed CVE-2020-7598 , a prototype pollution vulnerability in minimist, an npm package that parses command-line arguments. The package sees roughly 1 million
IncidentA Zip Slip vulnerability in the Golang package go-rpmutils could have allowed attackers to write arbitrary files outside intended directories during archive extraction. The vulnerability, tracked as C
GeneralYou ve probably heard the advice: Write clear code comments. Maybe you ve even enforced it in your team s style guide. But in security reviews, repositories often have helpful inline comments alongsid
IncidentOn June 7, attackers sent 4 million requests through a single unauthenticated REST API endpoint in the Gravity SMTP WordPress plugin. By that point, the vulnerability had been public for nearly three
IncidentA Major Shift in Security Priorities On September 24, 2021, OWASP released an updated Top 10 list that significantly altered the landscape of security priorities. SQL injection, which had long been a
IncidentWhat Happened In 2020, researcher Yeting Li discovered a Regular Expression Denial of Service (REDoS) vulnerability in UAParser.js, a widely-used JavaScript library for parsing user agent strings. The
