Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams912 Security Engineers1021 Compliance Teams274 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All912 Incident912 General269 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

912 articles in Incident · Clear filtersSort byNewest·Trending

Incident

Latest

4 min read

8 Million Downloads of Compromised Code

On November 26, 2018, security researchers discovered that event-stream —a widely-used npm package downloaded roughly 2 million times per week—had been compromised. The malicious code, hidden in a dep

For Security EngineersRead article

Zip Slip: When 60 Days Stood Between Discovery and Exploit

Incident

5 min read

Zip Slip: When 60 Days Stood Between Discovery and Exploit

What Happened In early 2018, Snyk s security research team discovered a directory traversal vulnerability in archive extraction code affecting thousands of projects across multiple ecosystems. The vul

For Security EngineersRead

npm Vulnerability Spike: 83% Jump in One Year

Incident

4 min read

npm Vulnerability Spike: 83% Jump in One Year

What Happened Between 2016 and 2017, the number of published vulnerabilities across tracked open-source ecosystems jumped 83 percent. The npm and Maven Central repositories — essential for JavaScript

For Security EngineersRead

event-stream: 3,931 Packages Backdoored Through One Maintainer Handoff

Incident

4 min read

event-stream: 3,931 Packages Backdoored Through One Maintainer Handoff

What Happened In September 2018, the maintainer of event-stream —an npm package downloaded 2 million times per week—transferred ownership to a new contributor after months of social engineering. Withi

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

NIST Stopped Analyzing 40% of CVEs: What Broke

Incident

4 min read

NIST Stopped Analyzing 40% of CVEs: What Broke

What Happened In 2024, the National Institute of Standards and Technology (NIST) s National Vulnerability Database (NVD) reduced its CVE enrichment operations, analyzing fewer vulnerabilities in depth

For Security EngineersRead

SharePoint RCE Under Active Attack: CVE-2026-45659

Incident

5 min read

SharePoint RCE Under Active Attack: CVE-2026-45659

What Happened Attackers are exploiting CVE-2026-45659 , a remote code execution vulnerability in Microsoft SharePoint. This flaw allows an authenticated user with low privileges to execute arbitrary c

For Security EngineersRead

Kubernetes CVE-2018-1002105: The Privilege Escalation That Broke API Authentication

Incident

6 min read

Kubernetes CVE-2018-1002105: The Privilege Escalation That Broke API Authentication

What Happened On December 3, 2018, the Kubernetes security team disclosed CVE-2018-1002105 , a critical vulnerability that allowed any authenticated user to escalate privileges and execute arbitrary c

For Security EngineersRead

SharePoint RCE Under Active Exploit: CVE-2026-45659

Incident

4 min read

SharePoint RCE Under Active Exploit: CVE-2026-45659

What Happened Microsoft SharePoint Server contains a deserialization vulnerability (CVE-2026-45659, CVSS 8.8) that allows authenticated attackers to execute arbitrary code remotely. CISA added this vu

For Security EngineersRead

Argo CD Unpatched Flaw: A Tier-Zero Wake-Up Call

Incident

4 min read

Argo CD Unpatched Flaw: A Tier-Zero Wake-Up Call

What Happened Security researchers at Synacktiv have disclosed a vulnerability in Argo CD s repo-server component that allows code execution and deployment manipulation within Kubernetes clusters. As

For Compliance TeamsRead

AI Found 1,596 Bugs in Nine Weeks. Then What?

Incident

5 min read

AI Found 1,596 Bugs in Nine Weeks. Then What?

What Happened Between late 2024 and early 2025, Anthropic s Claude Mythos Preview AI system identified 1,596 verified vulnerabilities in open-source projects through OSS-Fuzz over a nine-week period.

For Security EngineersRead

Exposed AI Endpoints: No Auth, Full Access

Incident

4 min read

Exposed AI Endpoints: No Auth, Full Access

What Happened Threat actors have exploited publicly accessible AI endpoints that lacked authentication controls. These endpoints—serving large language models, image generation systems, and other AI c

For Security EngineersRead

Mastra AI's npm Workflow Breach: A Governance Failure

Incident

4 min read

Mastra AI's npm Workflow Breach: A Governance Failure

What Happened In June 2026, attackers compromised the Mastra AI framework s npm publishing workflow. This breach allowed adversaries to control the package distribution mechanism, affecting the pipeli

For Security EngineersRead

Cursor's DuneSlide Flaws: Two Sandbox Escapes

Incident

4 min read

Cursor's DuneSlide Flaws: Two Sandbox Escapes

What Happened Cato AI Labs discovered two critical vulnerabilities in Cursor, the AI code editor used by more than half the Fortune 500. Both flaws—CVE-2026-50548 and CVE-2026-50549, each rated 9.8 ou

For Security EngineersRead

Codecov Breach: 61 Days of Undetected Pipeline Access

Incident

4 min read

Codecov Breach: 61 Days of Undetected Pipeline Access

What Happened In early 2021, an attacker modified a single line in Codecov s Bash Uploader script. This change caused the script to exfiltrate environment variables to an external server before execut

For Security EngineersRead

Adobe's July 2026 Patches: When AI Finds Flaws Faster Than Teams Can Fix Them

Incident

4 min read

Adobe's July 2026 Patches: When AI Finds Flaws Faster Than Teams Can Fix Them

What Happened Adobe released emergency patches for seven vulnerabilities with CVSS scores of 10.0 across ColdFusion and Campaign Classic. These flaws, including CVE-2026-48286, represent the maximum s

For Security EngineersRead

Adobe Ships Seven Max-Severity Patches: What Went Wrong

Incident

4 min read

Adobe Ships Seven Max-Severity Patches: What Went Wrong

Overview of the Vulnerabilities Adobe has released patches for seven maximum-severity vulnerabilities in ColdFusion and Campaign Classic. These vulnerabilities enable remote code execution through att

For Security EngineersRead

Showing 353-368 of 912 articles

PreviousPage 23 of 57Next