Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams82 Security Engineers451 Compliance Teams155 DevOps Leaders38 Developers28 CISOs8 IT Directors2

Topics:All82 Incident440 General91 Standards82 Research31 Guides25 Deadlines7 Vendor News4 Legal2

82 articles in Standards · Clear filtersSort byNewest·Trending

"Wait, this package is suddenly asking for what permissions?"

Standards

Latest

5 min read

"Wait, this package is suddenly asking for what permissions?"

These questions started showing up in security Slack channels right after StepSecurity flagged two hijacked npm packages in the React Native ecosystem. These packages, with over 30,000 downloads per w

For Security EngineersRead article

88 Malicious npm Packages Still Active: What the PhantomRaven Data Tells Us

Standards

4 min read

88 Malicious npm Packages Still Active: What the PhantomRaven Data Tells Us

Endor Labs researchers have identified 88 new malicious npm packages in the latest PhantomRaven campaign—81 of which are still available for download. These packages are actively stealing credentials

For Security EngineersRead

Stopping Self-Spreading Worms When You Can't Kill the Server

Standards

4 min read

Stopping Self-Spreading Worms When You Can't Kill the Server

On March 20, 2026, Aikido Security detected CanisterWorm spreading across the npm ecosystem. Within hours, it had compromised more than 50 packages across multiple scopes. The attack used the Internet

For Security EngineersRead

Defending Against Decentralized Malware: What the CanisterWorm Attack Means for Your Supply Chain

Standards

5 min read

Defending Against Decentralized Malware: What the CanisterWorm Attack Means for Your Supply Chain

Scope This guide covers detection and mitigation strategies for supply chain attacks using decentralized infrastructure for command-and-control operations. You ll learn to identify compromised package

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Package Manager Security: A Four-Stage Implementation Playbook

Standards

5 min read

Package Manager Security: A Four-Stage Implementation Playbook

Every npm install or pip install you run pulls code from strangers into your production systems. ENISA s Technical Advisory for Secure Use of Package Managers (March 2026) breaks dependency management

For DevelopersRead

Malicious Packages on Packagist: A Detection and Response Reference

Standards

5 min read

Malicious Packages on Packagist: A Detection and Response Reference

Scope This guide focuses on detecting, preventing, and remediating malicious packages in PHP Composer dependency chains, specifically targeting threats from Packagist . It covers reconnaissance method

For DevelopersRead

Should You Update Chrome Every Two Weeks?

Standards

4 min read

Should You Update Chrome Every Two Weeks?

Starting September 2026, Chrome will move to a two-week release cycle with version 153. If you re managing web applications in production, you need a clear decision framework for how your team respond

For DevelopersRead

How a Platform Team Cut Policy Sprawl by 60% with Unified Kubernetes Governance

Standards

5 min read

How a Platform Team Cut Policy Sprawl by 60% with Unified Kubernetes Governance

The Challenge Your platform engineering team might be managing multiple Kubernetes clusters across various environments. A common issue is policy chaos. One team adopted Kyverno as their policy engine

For Compliance TeamsRead

CMMC Questions Your Procurement Team Is Actually Asking

Standards

4 min read

CMMC Questions Your Procurement Team Is Actually Asking

These questions arise from recent experiences with contractors navigating the implications of the Cybersecurity Maturity Model Certification (CMMC) for their supplier relationships. With the Departmen

For Compliance TeamsRead

"We generate SBOMs, but nobody looks at them" — fixing the gap between SBOM creation and action

Standards

5 min read

"We generate SBOMs, but nobody looks at them" — fixing the gap between SBOM creation and action

Teams often find themselves generating Software Bill of Materials (SBOMs) without knowing how to use them effectively. They might have set up SBOM tooling in their CI/CD pipeline, generating thousands

For DevelopersRead

Best Buy Cut False Positives 80% by Moving Security Into the IDE

Standards

4 min read

Best Buy Cut False Positives 80% by Moving Security Into the IDE

The Challenge Security scanning tools often generate excessive noise. Your team is likely familiar with this issue. A typical enterprise application security (AppSec) program runs static application s

For Compliance TeamsRead

Implementing Security for AI-Assisted Development: A Working Playbook

Standards

5 min read

Implementing Security for AI-Assisted Development: A Working Playbook

Your security measures are outdated for a development process that has evolved. When AI agents continuously write code—not in sprints or releases—traditional security practices like quarterly pen test

For Security EngineersRead

When AI Found 500 Vulnerabilities Nobody Asked For

Standards

5 min read

When AI Found 500 Vulnerabilities Nobody Asked For

The Challenge Anthropic s Claude Code Security identified over 500 previously unknown high-severity vulnerabilities in open-source codebases. While this might seem like a win for security teams, it pr

For Security EngineersRead

AI Coding Tools Just Became Your Supply Chain's Weakest Link

Standards

5 min read

AI Coding Tools Just Became Your Supply Chain's Weakest Link

Your AI coding assistant just installed a malicious package. Not because it s compromised—because it made a typo. The SANDWORM_MODE campaign shows how AI tools like Claude Code and OpenClaw have becom

For Security EngineersRead

Dependency Management When AI Writes Half Your Code

Standards

5 min read

Dependency Management When AI Writes Half Your Code

Your AI coding assistant just suggested a library. Your developer accepted it. Your codebase now includes a new dependency with 47 transitive dependencies, three of which have known CVEs. This happene

For Compliance TeamsRead

70% of Critical Vulns Come From Memory Issues — Here's What One Team Actually Did

Standards

4 min read

70% of Critical Vulns Come From Memory Issues — Here's What One Team Actually Did

The Challenge A platform engineering team managing a 15-year-old C++ codebase faced a directive from their CISO: reduce memory-safety vulnerabilities by Q3 or plan a multi-year rewrite. The system pro

For DevelopersRead

Showing 33-48 of 82 articles

PreviousPage 3 of 6Next