Expert perspectives on application security, compliance, and emerging threats
IncidentOn June 3, 2026, the Joomla project released version 2.9.99.5 of its Content Editor (JCE) to patch CVE-2026-48907 , a vulnerability allowing arbitrary PHP code execution. CISA added this flaw to its K
IncidentWhat Happened On June 17, 2026, an attacker compromised a contributor account in the Mastra namespace and published 144 malicious npm packages within 88 minutes. Each package included a dependency on
ResearchYour team s JetBrains environment is now an attack vector. Since October 2025, malicious plugins posing as AI coding assistants have been stealing API keys from developer workstations. Two such plugin
IncidentOn January 14, 2025, security researchers disclosed SearchLeak, a three-stage prompt injection attack that exploited Microsoft Copilot s web search integration to exfiltrate user data through a single
Get weekly security insights and compliance updates delivered to your inbox.
GeneralYour team just implemented a 72-hour cooldown on all npm package updates. You feel safer. You shouldn t. Cooldowns offer a simple, measurable control in security: set a number, enforce it, check a box
IncidentOn June 13, Sansec disclosed a coordinated attack against three WordPress plugins owned by Awesome Motive: PushEngage, OptinMonster, and TrustPulse. Attackers modified JavaScript files served through
IncidentOn May 2, 2025, BerriAI released LiteLLM v1.83.14-stable, fixing a vulnerability chain that allowed low-privilege users to execute arbitrary code on the AI gateway server. Obsidian Security disclosed
IncidentWhat Happened Attackers are actively exploiting CVE-2026-5027, a path traversal vulnerability in Langflow that allows arbitrary file writes and remote code execution. The patch shipped in version 1.9.
IncidentOn December 18, 2024, the European Commission proposed the Cybersecurity Act 2.0 (CSA 2.0). While intended to enhance security, the regulation introduces a vendor classification mechanism that uses ge
IncidentIncident Overview An open-source project with over 35,000 GitHub stars experienced a full account takeover due to a vulnerability that many security tools would have flagged as low-priority or ignored
IncidentBetween late 2024 and early 2025, Snyk identified eight malicious npm packages that exploited pre- and post-install scripts to execute arbitrary commands on developer machines. Although these packages
GuidesThe EU Cyber Resilience Act becomes applicable in December 2027. If you sell software products in the EU, you need verifiable Software Bills of Materials (SBOMs) for everything you ship. These must be
IncidentOn a Friday evening in late 2024, websites using OptinMonster began serving malicious JavaScript to visitors. The attack originated from a compromised content delivery network (CDN), not OptinMonster
IncidentWhat Happened Security researchers Mario Stathako and colleagues found that npm s package aliasing feature—intended to let developers install packages under different names—creates a new risk for depe
IncidentThe Threat of IDE Extensions Snyk s security research team discovered remote code execution vulnerabilities in Visual Studio Code extensions available through the official marketplace. A significant e
IncidentWhat Happened Elastic Security Labs has introduced the CI/CD Abuse Detector, an open-source prototype that employs a large language model (LLM) to scan pipeline changes for suspicious activity before
