Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams911 Security Engineers1020 Compliance Teams274 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All911 Incident911 General269 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

911 articles in Incident · Clear filtersSort byNewest·Trending

Incident

Latest

4 min read

Google Bans AI Bug Reports From Its VRP

What Happened Google has announced it will no longer accept AI-generated submissions to its Open Source Software Vulnerability Reward Program (VRP). This decision follows a trend of low-quality report

For Security EngineersRead article

Eight Ways to Lose Control of Your AI Environment

Incident

4 min read

Eight Ways to Lose Control of Your AI Environment

The XM Cyber threat research team identified eight distinct attack vectors in AWS Bedrock environments. None of these exploits rely on zero-days or novel techniques. They all hinge on a single point o

For Security EngineersRead

ServiceNow's August 2026 Patch: Four Flaws, Three at Maximum Severity

Incident

4 min read

ServiceNow's August 2026 Patch: Four Flaws, Three at Maximum Severity

What Happened On August 27, 2026, ServiceNow disclosed four vulnerabilities in its AI Platform, with three rated at the highest severity level, CVSS 10.0. These flaws allow attackers to execute arbitr

For Compliance TeamsRead

ServiceNow AI Platform Vulnerabilities: What Went Wrong

Incident

4 min read

ServiceNow AI Platform Vulnerabilities: What Went Wrong

ServiceNow disclosed three critical vulnerabilities in its AI Platform on January 14, 2025. All three received CVSS scores at maximum severity. The flaws, CVE-2026-18885 (code injection), CVE-2026-188

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

ServiceNow AI Platform Flaws: Three Injection Paths to Your Data

Incident

4 min read

ServiceNow AI Platform Flaws: Three Injection Paths to Your Data

What Happened ServiceNow patched three critical vulnerabilities in its AI Platform that allowed unauthenticated attackers to execute arbitrary code and SQL statements without user interaction. The vul

For Security EngineersRead

NVD Reclassified 30,000 Vulnerabilities: What Broke

Incident

4 min read

NVD Reclassified 30,000 Vulnerabilities: What Broke

In April 2026, NIST reclassified roughly 30,000 vulnerabilities in the National Vulnerability Database as Not Scheduled. If your team relied on NVD as your single source of truth, you just lost visibi

For Security EngineersRead

GiveWP Flaw Exposes 100,000 Sites to Remote Takeover

Incident

5 min read

GiveWP Flaw Exposes 100,000 Sites to Remote Takeover

An unauthenticated attacker just created an admin account on a nonprofit s WordPress site. They didn t need credentials or exploit a complex chain. They sent a single HTTP request to a donation form.

For Security EngineersRead

893 Malicious Packages Stopped at the Gate

Incident

4 min read

893 Malicious Packages Stopped at the Gate

The Threat Landscape In 2025, financial services organizations blocked 893 malicious packages from entering their development environments. By mid-2026, they d intercepted 572 more. These packages wer

For Compliance TeamsRead

8,300 Gitea Servers Still Vulnerable One Month After Patch

Incident

4 min read

8,300 Gitea Servers Still Vulnerable One Month After Patch

What happened On July 27, Gitea released version 1.27.1 to patch CVE-2026-60004, a critical remote code execution vulnerability in its diffpatch API endpoint. This flaw allows attackers to execute arb

For Security EngineersRead

Incident

4 min read

Zero-Click Prompt Injection at Scale

What Happened In early 2024, security researchers disclosed EchoLeak, a zero-click prompt injection vulnerability in Microsoft 365 Copilot with a CVSS score of 9.3. This flaw allowed attackers to mani

For Security EngineersRead

Incident

4 min read

Two RCE Flaws in Next.js: What Broke

On April 17, 2025, Vercel shipped emergency patches for Next.js after discovering two critical vulnerabilities that let unauthenticated attackers execute arbitrary code on affected servers. One exploi

For Security EngineersRead

Two Arrests, Thousand Compromises: TeamPCP Teardown

Incident

4 min read

Two Arrests, Thousand Compromises: TeamPCP Teardown

A coordinated operation by the Australian Federal Police has led to the arrest of two individuals linked to TeamPCP, a hacking group responsible for supply-chain attacks that compromised over a thousa

For Security EngineersRead

Two Arrests Expose a Supply Chain Breach Pattern

Incident

4 min read

Two Arrests Expose a Supply Chain Breach Pattern

The Australian Federal Police charged two men with 14 offenses tied to TeamPCP, a cybercrime group that compromised multiple open-source security tools to distribute malware through trusted channels.

For Compliance TeamsRead

Two Arrests, 3,800 Repositories: The TeamPCP Supply Chain Attack

Incident

4 min read

Two Arrests, 3,800 Repositories: The TeamPCP Supply Chain Attack

What Happened Australian Federal Police arrested two individuals linked to TeamPCP, a cybercrime group that compromised at least 3,800 GitHub repositories. The group deployed Shai-Hulud, a self-propag

For Security EngineersRead

1,000 Organizations Hit Through Poisoned npm Packages

Incident

4 min read

1,000 Organizations Hit Through Poisoned npm Packages

In April 2026, cyber threat assessment firms discovered malicious code in open-source npm packages. By the time Australian Federal Police and the FBI arrested two alleged members of TeamPCP, over 1,00

For Security EngineersRead

Incident

4 min read

Kiro IDE Vulnerability: What Went Wrong

A prompt injection flaw in Amazon s Kiro IDE allowed attackers to exfiltrate source code and credentials through a feature meant to assist developers. Disclosed by Mindgard in late 2024, the vulnerabi

For Security EngineersRead

Showing 33-48 of 911 articles

PreviousPage 3 of 57Next