Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams142 Security Engineers142 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All142 Incident142 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

142 articles in Incident · Clear filtersSort byNewest·Trending

When AI Found 10,000 Vulnerabilities in Your Codebase and Your Team Had Capacity for 200

Incident

Latest

4 min read

When AI Found 10,000 Vulnerabilities in Your Codebase and Your Team Had Capacity for 200

The Challenge of AI-Driven Vulnerability Discovery On April 7, Anthropic released Claude Mythos Preview, an AI system designed to identify security vulnerabilities at scale. This tool promised to scan

For Compliance TeamsRead article

20 Hours: The Langflow RCE Exploit Timeline

Incident

4 min read

20 Hours: The Langflow RCE Exploit Timeline

What Happened A critical remote code execution vulnerability in Langflow—an open-source tool for building AI pipelines—was exploited in the wild within 20 hours of public disclosure. The vulnerability

For Security EngineersRead

Google Cloud Vertex AI Permissions Flaw: When Default Service Agents Become Data Exfiltration Paths

Incident

4 min read

Google Cloud Vertex AI Permissions Flaw: When Default Service Agents Become Data Exfiltration Paths

Overview of the Vulnerability Unit 42 researchers have identified a vulnerability in Google Cloud Vertex AI s permission model. This flaw allows attackers with compromised credentials to escalate priv

For Compliance TeamsRead

Axios npm Package Compromised: A Two-Hour Window That Could Have Wrecked Your Pipeline

Incident

4 min read

Axios npm Package Compromised: A Two-Hour Window That Could Have Wrecked Your Pipeline

What Happened On March 31, 2026, malicious versions of the axios npm package (1.14.1 and 0.30.4) were published to the npm registry using a compromised maintainer account (@jasonsaayman). The attacker

For Compliance TeamsRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Axios npm Hijack: When 18 Hours of Prep Time Beat Your Dependency Checks

Incident

3 min read

Axios npm Hijack: When 18 Hours of Prep Time Beat Your Dependency Checks

What Happened Recently, attackers published two malicious versions of Axios—the npm HTTP client used by millions of JavaScript applications. Versions 1.14.1 and 0.30.4 introduced a dependency called p

For Compliance TeamsRead

Cisco Lost 300+ Repositories to a Malicious GitHub Action

Incident

4 min read

Cisco Lost 300+ Repositories to a Malicious GitHub Action

What Happened Cisco s development environment was compromised when attackers used credentials stolen from a supply chain attack on Trivy, an open-source vulnerability scanner. The threat group TeamPCP

For Compliance TeamsRead

Two OpenAI Vulnerabilities Expose the Input Validation Gap in AI Tools

Incident

5 min read

Two OpenAI Vulnerabilities Expose the Input Validation Gap in AI Tools

What Happened OpenAI recently patched two vulnerabilities in its AI products that could have enabled unauthorized data movement. The first, discovered by BeyondTrust researchers, affected Codex: a com

For Security EngineersRead

The Trivy Compromise: 75 Version Tags Poisoned in 24 Hours

Incident

4 min read

The Trivy Compromise: 75 Version Tags Poisoned in 24 Hours

What Happened Attackers compromised the Aqua Security repository hosting Trivy , a widely used vulnerability scanner, poisoning 75 of 76 version tags. This turned a tool meant to find vulnerabilities

For Security EngineersRead

513,000 Lines of AI Code Leaked Through a Source Map

Incident

4 min read

513,000 Lines of AI Code Leaked Through a Source Map

What Happened Security researcher Chaofan Shou recently discovered that Anthropic accidentally exposed the complete source code for Claude Code—their AI coding agent—through a public npm package. The

For Security EngineersRead

1,700 Malicious Packages: How UNC1069 Weaponized Four Package Ecosystems

Incident

5 min read

1,700 Malicious Packages: How UNC1069 Weaponized Four Package Ecosystems

What Happened Since January 2025, threat actor UNC1069—linked to North Korean groups BlueNoroff, Sapphire Sleet, and Stardust Chollima—deployed over 1,700 malicious packages across npm, PyPI, Go, and

For Security EngineersRead

21,764 Malware Packages in 90 Days: What npm's Supply Chain Crisis Teaches Us

Incident

3 min read

21,764 Malware Packages in 90 Days: What npm's Supply Chain Crisis Teaches Us

The Crisis Unfolds In Q1 2026, Sonatype identified 21,764 malicious packages in open source repositories, with npm accounting for 75% of these. That s 16,323 malicious packages targeting JavaScript de

For Security EngineersRead

AI Scans 100,000 Repositories in 72 Hours: The PRT-scan Attack

Incident

3 min read

AI Scans 100,000 Repositories in 72 Hours: The PRT-scan Attack

Overview of the Attack An attacker used an AI tool named PRT-scan to systematically scan GitHub repositories for misconfigurations that expose secrets. This attack automated the process of reconnaissa

For Security EngineersRead

When AI Finds Your CVE Before You Patch It

Incident

4 min read

When AI Finds Your CVE Before You Patch It

The Emerging Threat Vulnerabilities are being exploited faster than your team can deploy patches. The traditional workflow—discover, prioritize, test, deploy—now lags behind the speed of exploitation.

For CISOsRead

Anthropic's MCP Vulnerability: When "Expected Behavior" Means Remote Code Execution

Incident

5 min read

Anthropic's MCP Vulnerability: When "Expected Behavior" Means Remote Code Execution

What Happened In early 2025, security researchers at OX Security disclosed a critical vulnerability in Anthropic s Model Context Protocol (MCP) that allows remote code execution. This flaw affects ove

For Compliance TeamsRead

How a Compromised AI Tool Gave Attackers Full Access to Vercel's Infrastructure

Incident

5 min read

How a Compromised AI Tool Gave Attackers Full Access to Vercel's Infrastructure

What Happened On December 20, 2024, Vercel discovered unauthorized access to their internal systems through a compromised OAuth token belonging to Context.ai, a third-party AI coding assistant integra

For Compliance TeamsRead

Bitwarden CLI Trojan: How a GitHub Action Became a Supply Chain Weapon

Incident

4 min read

Bitwarden CLI Trojan: How a GitHub Action Became a Supply Chain Weapon

What Happened On April 22, 2025, attackers published a malicious version of the Bitwarden CLI password manager (version 2026.4.0) to the npm registry. The compromised package was available for about 1

For Security EngineersRead

Showing 33-48 of 142 articles

PreviousPage 3 of 9Next