Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams697 Security Engineers759 Compliance Teams223 DevOps Leaders63 Developers31 CISOs17 IT Directors2

Topics:All697 Incident707 General188 Standards88 Research61 Guides34 Deadlines11 Vendor News4 Legal2

697 articles in Incident · Clear filtersSort byNewest·Trending

Jinja2 XSS: When 90,000 Projects Missed a Patch

Incident

Latest

5 min read

Jinja2 XSS: When 90,000 Projects Missed a Patch

What Happened CVE-2024-22195 exposed a cross-site scripting vulnerability in Jinja2, the Python templating library with over 33 million weekly downloads. The flaw existed in all versions prior to 3.1.

For Security EngineersRead article

100,000 Sites Poisoned Through One CDN Takeover

Incident

5 min read

100,000 Sites Poisoned Through One CDN Takeover

What Happened A Chinese company named Funnull acquired the polyfill.io domain and CDN service in February 2024. Soon after, the new owners injected malicious code into the JavaScript files served from

For Security EngineersRead

21% Still Vulnerable to Log4Shell: A Remediation Failure

Incident

4 min read

21% Still Vulnerable to Log4Shell: A Remediation Failure

What Happened Three years after Log4Shell was disclosed, 21% of companies still run projects with this critical vulnerability. Spring4Shell fares worse: 35% of companies haven t patched it. This isn t

For DevOps LeadersRead

CVE-2024-24762: When a Regex Pattern Took Down FastAPI Apps

Incident

4 min read

CVE-2024-24762: When a Regex Pattern Took Down FastAPI Apps

What Happened FastAPI applications using the python-multipart package were exposed to regular expression denial of service (ReDoS) attacks through CVE-2024-24762. This vulnerability arose from an inse

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

AI Agent Installed Malware in Production Build

Incident

4 min read

AI Agent Installed Malware in Production Build

Your CI/CD pipeline just pulled a malicious package. The commit shows an AI coding agent added it. The security alert lands on your desk. Who do you hold accountable? AI coding agents are autonomously

For Security EngineersRead

Lottie Player Breach: When a Compromised npm Package Exposes Your Users

Incident

3 min read

Lottie Player Breach: When a Compromised npm Package Exposes Your Users

What Happened Recently, attackers compromised the npm package @lottiefiles/lottie-player , injecting malicious code to steal cryptocurrency wallet credentials. They released three tainted versions—2.0

For Security EngineersRead

PyPI Malware Hid in GitHub Actions for 72 Hours

Incident

4 min read

PyPI Malware Hid in GitHub Actions for 72 Hours

On December 4, 2024, attackers published malicious versions of Ultralytics, a widely-used Python library for YOLO object detection models, to the Python Package Index (PyPI). The attack exploited GitH

For DevOps LeadersRead

Backdoor in BoltDB Fork Went Undetected for 3 Years

Incident

4 min read

Backdoor in BoltDB Fork Went Undetected for 3 Years

What Happened A typo-squatting attack on the BoltDB Go module was active from November 2021 until January 30, 2025. The malicious package—version 1.3.1 of a forked repository—contained a backdoor that

For Security EngineersRead

62,000 Packages, 50,000 CVEs: Why IBM's $5B Bet Matters

Incident

4 min read

62,000 Packages, 50,000 CVEs: Why IBM's $5B Bet Matters

The Challenge of Open Source Security IBM and Red Hat have launched Project Lightwell, a $5 billion initiative involving 20,000 engineers to create a security clearinghouse for open source software. T

For Security EngineersRead

23,000 Repos Ran Backdoored GitHub Actions

Incident

6 min read

23,000 Repos Ran Backdoored GitHub Actions

What Happened In early 2024, an attacker with write access to the tj-actions/changed-files repository modified the GitHub Action to expose encrypted secrets in plaintext within workflow logs. This Act

For DevOps LeadersRead

Critical Gogs Vulnerability Sits Unpatched for 60+ Days

Incident

4 min read

Critical Gogs Vulnerability Sits Unpatched for 60+ Days

What Happened A critical remote code execution vulnerability in Gogs , a self-hosted Git service, remains unpatched more than two months after Rapid7 reported it to the project maintainer. The vulnera

For Security EngineersRead

Next.js CVE-2025-29927: Authorization Bypass

Incident

4 min read

Next.js CVE-2025-29927: Authorization Bypass

What Happened A critical authorization bypass vulnerability in Next.js middleware allowed attackers to circumvent authentication checks by manipulating HTTP headers. CVE-2025-29927, with a severity sc

For Security EngineersRead

CVE-2026-3199: When Repository Patching Falls Behind

Incident

4 min read

CVE-2026-3199: When Repository Patching Falls Behind

What Happened Sonatype Nexus Repository versions using OrientDB faced CVE-2026-3199 , an authenticated remote code execution vulnerability with a CVSS score of 9.4. An attacker with valid credentials

For Security EngineersRead

Gogs RCE: When Repository Settings Become Attack Vectors

Incident

5 min read

Gogs RCE: When Repository Settings Become Attack Vectors

What Happened On March 17, 2026, Rapid7 researcher Jonah Burgess disclosed a critical remote code execution vulnerability in Gogs , a self-hosted Git service used by development teams. The flaw, rated

For Security EngineersRead

GlassWorm Takedown: 157 False Positives Later

Incident

3 min read

GlassWorm Takedown: 157 False Positives Later

What Happened On May 26 at 14:00 UTC, CrowdStrike coordinated the takedown of GlassWorm, a malware operation distributing malicious packages through public repositories. The operation initially seemed

For Security EngineersRead

176 Malicious npm Packages Hijacked CI/CD Pipelines

Incident

4 min read

176 Malicious npm Packages Hijacked CI/CD Pipelines

What Happened Sonatype researchers discovered 176 malicious npm packages exploiting dependency confusion to compromise developer environments and CI/CD systems. Attackers published packages with names

For Security EngineersRead

Showing 369-384 of 697 articles

PreviousPage 24 of 44Next