Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened On May 5, 2025, Redis released patches addressing CVE-2026-23479, a critical remote code execution vulnerability present since version 7.2.0. This flaw allows authenticated users to exec
IncidentWhat Happened On May 4, 2026, security researcher CHOIGYENGMIN reported CVE-2026-8206 to Wordfence: a critical vulnerability in the Kirki WordPress plugin that allows unauthenticated attackers to hija
IncidentMicrosoft recently updated its security tools to address a critical gap: vulnerability scanners were identifying issues in code, but security teams couldn t determine which ones were significant in pr
IncidentWhat Happened On January 8, 2025, CISA added CVE-2024-21182 to its Known Exploited Vulnerabilities catalog. This vulnerability affects Oracle WebLogic Server and allows remote code execution. Oracle r
Get weekly security insights and compliance updates delivered to your inbox.
IncidentA compromised Red Hat employee GitHub account led to malicious code being published across at least 32 npm packages under the @redhat-cloud-services namespace. These packages, with roughly 80,000 comb
IncidentWhat Happened In early 2025, attackers compromised a GitHub account with publishing access to Red Hat s @redhat-cloud-services npm namespace. They injected the Miasma malware into over 30 packages, wh
IncidentWhat Happened In late 2024 or early 2025, attackers began exploiting CVE-2024-21182, a high-severity vulnerability in Oracle WebLogic Server. This flaw allows unauthenticated attackers to compromise a
IncidentOn June 1, 2026, attackers published over 30 compromised npm packages under Red Hat s Cloud Services namespace. These packages contained Mini Shai-Hulud malware designed to exfiltrate credentials from
IncidentOn May 25, 2026, Johannes Link released jqwik version 1.10.0 to Maven Central with a deliberate prompt injection designed to sabotage AI coding agents. The Java testing library s maintainer embedded i
IncidentWhat Happened In early 2025, security researchers at Wiz discovered unauthorized code modifications in at least 32 package releases within Red Hat s npm namespace. These packages, linked to the Shai-H
IncidentOn a routine Thursday, packages under the @redhat-cloud-services namespace on npm began executing malware during installation. The compromised packages—including @redhat-cloud-services/types—ran malic
IncidentIncident Overview The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-21182 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch Oracle WebLogic S
IncidentWhat Happened Between April and May 2026, attackers compromised Red Hat s GitHub credentials and injected malicious code into npm packages maintained by the company. The malware, dubbed Miasma: The Sp
IncidentUnderstanding the Vulnerability CVE-2022-31692 revealed a critical flaw in Spring Security versions 5.6.x through 5.7.4, scoring 9.8 on the National Vulnerability Database. Applications using RegexReq
IncidentWhat Happened On January 4, CircleCI discovered unauthorized access to their systems and immediately advised all customers to rotate their secrets. The company invalidated Personal and Project API tok
IncidentWhat Happened Obsidian Security disclosed CVE-2026-40933, a critical remote code execution vulnerability in Flowise s Model Context Protocol (MCP) stdio server implementation. The vulnerability has a
