Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams912 Security Engineers1021 Compliance Teams274 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All912 Incident912 General269 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

912 articles in Incident · Clear filtersSort byNewest·Trending

AI Agent Runs Malware from Clean Repository

Incident

Latest

5 min read

AI Agent Runs Malware from Clean Repository

What Happened Mozilla s Zero Day Investigative Network (0DIN) demonstrated an attack exploiting AI coding agents through legitimate-looking GitHub repositories. The repository contained no malicious c

For Security EngineersRead article

2.9.9 Shipped with RCE: Spring Boot's Transitive Dependency Failure

Incident

4 min read

2.9.9 Shipped with RCE: Spring Boot's Transitive Dependency Failure

What Happened Spring Boot version 2.1.7 shipped with jackson-databind 2.9.9, a JSON parsing library containing two high-severity deserialization vulnerabilities (CVE-2019-14379 and CVE-2019-14439). Th

For Security EngineersRead

Web Shells Deployed via Patched Windchill Flaw

Incident

4 min read

Web Shells Deployed via Patched Windchill Flaw

What Happened Attackers are exploiting CVE-2026-12569 , a remote code execution vulnerability in PTC Windchill, to deploy web shells on vulnerable systems. The flaw has a CVSS score of 9.3. CISA added

For Security EngineersRead

MacOS Malware Commands AI Tools to Stop Analysis

Incident

4 min read

MacOS Malware Commands AI Tools to Stop Analysis

What Happened SentinelLabs identified malware targeting MacOS systems that contains instructions designed to make LLM-assisted security products abort their analysis. The malware, detected under the r

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Leo Platform npm Breach: Trust Model Failure

Incident

4 min read

Leo Platform npm Breach: Trust Model Failure

What Happened On June 25, 2026, researchers identified a supply chain breach affecting the Leo Platform ecosystem on npm. Sonatype found 23 malicious package versions linked to the Shai-Hulud Miasma c

For Security EngineersRead

npm Package Attack Harvested GitHub Tokens

Incident

4 min read

npm Package Attack Harvested GitHub Tokens

A supply chain attack targeting npm packages and GitHub Actions workflows revealed how attackers can now move across package ecosystems to harvest developer credentials at scale. The Miasma malware ca

For Security EngineersRead

Incident

4 min read

$3M Drained Through a Vendor Script

In January 2025, Polymarket users experienced a significant security breach when $3 million in cryptocurrency vanished from their wallets. The culprit? Malicious JavaScript injected through a third-pa

For Security EngineersRead

rest-client Breach: One Stolen Password, Thousands of Vulnerable Apps

Incident

4 min read

rest-client Breach: One Stolen Password, Thousands of Vulnerable Apps

What Happened In August 2019, an attacker compromised a maintainer s RubyGems account for the rest-client library and inserted malicious code into versions 1.6.11 through 1.6.13. This backdoor allowed

For Security EngineersRead

Incident

4 min read

When a Framework Launches Without an Incident

The Linux Foundation announced Akrites in early 2025, introducing it as a shared Security Incident Response Team (SIRT) and Coordinated Vulnerability Disclosure (CVD) process for open-source projects.

For Compliance TeamsRead

4,200 Packages Scanned, 847 CVEs Found, 12 Actually Mattered

Incident

4 min read

4,200 Packages Scanned, 847 CVEs Found, 12 Actually Mattered

What Happened Your .NET development team might spend weeks triaging vulnerability alerts from your software composition analysis (SCA) tool. Imagine your application pulls in 4,200 NuGet packages acro

For Security EngineersRead

Role Tags Failed: The Injection Attack Pattern LLMs Can't Fix

Incident

4 min read

Role Tags Failed: The Injection Attack Pattern LLMs Can't Fix

What Happened Security researchers have found that modern LLMs rely heavily on role tags—such as system prompts and user designations—as their primary security framework. However, these tags do not pe

For Security EngineersRead

Sequelize SQL Injection: When Your ORM Fails

Incident

4 min read

Sequelize SQL Injection: When Your ORM Fails

In June 2019, Snyk discovered SQL injection vulnerabilities in Sequelize, a widely-used ORM library in the Node.js ecosystem. These flaws affected versions below 5.8.11 for MySQL and MariaDB, and vers

For Security EngineersRead

Spring Boot 2.7 Hit End-of-Life With 143 CVEs

Incident

4 min read

Spring Boot 2.7 Hit End-of-Life With 143 CVEs

What Happened In November 2023, Spring Boot 2.7 reached end-of-life. If your organization is still using this version, you re dealing with 143 known CVEs across 79 projects in your dependency tree. Th

For Security EngineersRead

Incident

4 min read

NVD Stops Enriching Most CVEs: Teardown

What Happened On April 15, 2026, NIST announced that the National Vulnerability Database (NVD) would stop providing comprehensive enrichment for most Common Vulnerabilities and Exposures (CVEs). Inste

For Security EngineersRead

84% of Sites Still Running Vulnerable jQuery

Incident

4 min read

84% of Sites Still Running Vulnerable jQuery

Overview of the Issue In August 2019, W3Techs scanned websites and found jQuery running on 73% of them. Snyk s security research revealed that 83.4% of those jQuery installations used the 1.x release

For Security EngineersRead

Agentic AI Broke the Timeline: A 2026 Attack Teardown

Incident

4 min read

Agentic AI Broke the Timeline: A 2026 Attack Teardown

In early 2026, the timeline between discovering a vulnerability and its exploitation shrank dramatically—from days or weeks to mere hours. Security teams accustomed to a predictable patching schedule

For Security EngineersRead

Showing 401-416 of 912 articles

PreviousPage 26 of 57Next