Insights & Analysis

Greyware Blocked in 52,000 Packages: What the Data Reveals

Your marketing team recently used an AI agent to build a customer analytics dashboard. The agent selected three npm packages that seemed perfect: tracking user behavior, exporting data to CSV, and sen

ServiceNow's Unauthenticated API: A Teardown

What Happened On June 5, ServiceNow issued security update KB3067321 for hosted customers after discovering an API endpoint that allowed unauthenticated access to customer data. The vulnerable endpoin

Intent-Based Code Review: A Security Engineer's Implementation Guide

Scope This guide focuses on transitioning from traditional line-by-line code reviews to intent verification systems for teams facing AI-generated code bottlenecks. You ll find specific steps for imple

158,000 Magento Sites Left Exposed by Template Engine Flaw

Overview of the Vulnerability On February 13, 2022, Adobe disclosed CVE-2022-24086 , a critical arbitrary code execution vulnerability in the Magento template engine. This flaw affected Magento Open S

Malicious npm Package Used Invisible Unicode to Hide Backdoor

What Happened Between late 2024 and early 2025, attackers published malicious Node.js packages to npm that used invisible Unicode characters and package manager configuration files to execute hidden c

CVE-2022-0847: When Container Isolation Doesn't Matter

Overview of the Vulnerability A vulnerability in the Linux kernel pipe implementation, known as CVE-2022-0847 , allowed any process to overwrite data in arbitrary read-only files. Dubbed Dirty Pipe, t

Magento's Two-Patch Vulnerability: A Case Study in Incomplete Remediation

What Happened Adobe released a security patch for Magento in February 2022 to address CVE-2022-24086 , a critical vulnerability allowing SQL injection or PHP object injection during checkout for unaut

Automated Pentest Passed—Controls Still Failed

What Happened Your security team ran quarterly automated penetration tests on your production environment. The reports showed stable results: no critical findings and a few medium-severity issues alre

95% of CISOs Admit to Suppressing Security Findings

The Issue at Hand Between late 2024 and early 2025, Checkmarx commissioned Censuswide to survey security and development leaders in organizations using AI code generation tools. The findings revealed

The node-ipc Sabotage: When Protest Code Destroyed Production Files

On March 15, 2022, thousands of developers running npm install unknowingly pulled malicious code into their projects. The maintainer of node-ipc—a widely-used inter-process communication library—intro

3.4x More Vulnerabilities: What Happened When Enterprises Bet on AI Code

The Challenge Your development team has boosted sprint velocity by 40%. Code moves from developer workstations to production faster than ever. Pull requests that once took days now close in hours. The

AI Won't Replace Your Pentesters Yet

Security vendors and AI labs are promoting large language models as the future of automated vulnerability detection. The excitement peaked when XBOW evaluated Anthropic s Mythos Preview model, noting

Miasma Worm Leak: When GitHub Became the Distribution Channel

What Happened The Miasma worm s source code was deliberately distributed on GitHub through compromised developer accounts. Unlike accidental exposures or proof-of-concept leaks, this was a targeted at

AI Red Team Missed Probabilistic Jailbreak: What Went Wrong

84 npm Packages Poisoned Despite SLSA L3

On May 11, 2026, attackers published 84 malicious npm packages across 42 @tanstack repositories. Each package carried cryptographically valid SLSA Build Level 3 attestations. If your team relies on SL