Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams707 Security Engineers759 Compliance Teams223 DevOps Leaders63 Developers31 CISOs17 IT Directors2

Topics:All707 Incident707 General188 Standards88 Research61 Guides34 Deadlines11 Vendor News4 Legal2

707 articles in Incident · Clear filtersSort byNewest·Trending

700 Ghost CMS Sites Hijacked Through SQL Injection

Incident

Latest

4 min read

700 Ghost CMS Sites Hijacked Through SQL Injection

Over 700 websites using Ghost CMS were compromised in February and March 2026 due to CVE-2026-26980, a critical SQL injection vulnerability in the platform s Content API. Attackers exploited this flaw

For Security EngineersRead article

700 Sites Compromised After Ghost CMS Patch Sat Idle

Incident

5 min read

700 Sites Compromised After Ghost CMS Patch Sat Idle

On February 19, 2025, Ghost CMS released version 6.19.1, addressing CVE-2026-26980, a critical SQL injection vulnerability affecting versions 3.24.0 through 6.19.0. This flaw allowed attackers to read

For Compliance TeamsRead

AI Vulnerability Scanner Missed Critical Access Controls

Incident

4 min read

AI Vulnerability Scanner Missed Critical Access Controls

Overview of the Issue This analysis explores the pitfalls when security teams deploy AI-powered vulnerability scanners without understanding their limitations. OpenHack, an MIT-licensed tool by Hadria

For Security EngineersRead

Server-Side Execution via HTTP Body: The React Deserialization Flaw

Incident

4 min read

Server-Side Execution via HTTP Body: The React Deserialization Flaw

What Happened CVE-2025-55182 enables unauthenticated remote code execution through unsafe deserialization in React Server Components (RSC). Security researcher Lachlan Davidson reported the vulnerabil

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Incident

4 min read

When CI Catches What Your IDE Missed

The Challenge of AI-Accelerated Development Your development team is moving fast with tools like GitHub Copilot or Cursor, shipping features in hours instead of days. However, this speed comes with ri

For Security EngineersRead

npm Maintainer Accounts Hijacked: What Staged Publishing Fixes

Incident

4 min read

npm Maintainer Accounts Hijacked: What Staged Publishing Fixes

What Happened Between 2021 and 2024, attackers compromised multiple npm maintainer accounts to inject malicious code into legitimate packages. They gained access through credential stuffing, phishing,

For Security EngineersRead

Malware in @vietmoney/react-big-calendar: A Supply Chain Failure

Incident

3 min read

Malware in @vietmoney/react-big-calendar: A Supply Chain Failure

What Happened On December 29, 2025, malware was discovered in the @vietmoney/react-big-calendar npm package (version 0.26.2). This malware, called Shai-Hulud 3.0, targeted software supply chains durin

For Security EngineersRead

Incident

4 min read

Trust Wallet Lost $8.5M in 48 Hours

What Happened In a supply chain attack on Trust Wallet , attackers registered a typosquatted domain mimicking the legitimate Trust Wallet site. This malicious domain was embedded in third-party script

For Security EngineersRead

700 Package Versions Poisoned Through Git Tag Manipulation

Incident

5 min read

700 Package Versions Poisoned Through Git Tag Manipulation

On December 16, 2024, attackers compromised the Laravel Lang localization package ecosystem by rewriting GitHub version tags to point at malicious commits in their own forks. The attack affected 233 v

For Security EngineersRead

Incident

4 min read

Apache Tika's CVSS 10.0 XXE Flaw

Your application code passes every security review. Your internal XML parsing follows OWASP ASVS v4.0.3 guidance. But when Apache Tika 2.9.2 shipped with CVE-2025-66516—a CVSS 10.0 Critical XXE vulner

For Security EngineersRead

Eight Packagist Packages Delivered Linux Malware Through package.json

Incident

4 min read

Eight Packagist Packages Delivered Linux Malware Through package.json

What Happened Eight packages on Packagist , the primary PHP package repository, contained malicious code that downloaded and executed a Linux binary from GitHub. The attack bypassed PHP files by inser

For Security EngineersRead

Incident

3 min read

ASAPP's Red Team Finds 50+ Flaws Daily

Introduction: The Need for Continuous Adversarial Testing ASAPP, an enterprise AI provider, identified a significant gap in their security strategy: traditional pre-deployment testing couldn t keep up

For Security EngineersRead

Incident

4 min read

700 Malicious Versions in 24 Hours

On a quiet Tuesday, the Laravel-Lang organization s PHP localization packages became a delivery mechanism for credential theft across Windows, Linux, and macOS systems. More than 700 compromised packa

For Compliance TeamsRead

Shai-Hulud npm Attack: What Broke and What to Fix

Incident

4 min read

Shai-Hulud npm Attack: What Broke and What to Fix

Incident Overview In the Shai-Hulud incident, attackers published malicious npm packages containing hidden exfiltration scripts. These packages bypassed initial security checks and infiltrated product

For Security EngineersRead

15,000 Exploit Attempts in Days: The Drupal SQL Injection Timeline

Incident

4 min read

15,000 Exploit Attempts in Days: The Drupal SQL Injection Timeline

What Happened CVE-2026-9082 , a SQL injection vulnerability in Drupal Core with a CVSS score of 6.5, moved from patch release to active exploitation faster than most security teams could deploy fixes.

For Security EngineersRead

Drupal SQL Injection: When Risk Scores Collide

Incident

4 min read

Drupal SQL Injection: When Risk Scores Collide

What Happened Drupal disclosed CVE-2026-9082 , a SQL injection vulnerability in its database abstraction API that allows unauthorized database access and potential remote code execution. The flaw affe

For Compliance TeamsRead

Showing 417-432 of 707 articles

PreviousPage 27 of 45Next