Expert perspectives on application security, compliance, and emerging threats
IncidentOn January 14, 2025, security researchers disclosed SearchLeak, a three-stage prompt injection attack that exploited Microsoft Copilot s web search integration to exfiltrate user data through a single
IncidentOn June 13, Sansec disclosed a coordinated attack against three WordPress plugins owned by Awesome Motive: PushEngage, OptinMonster, and TrustPulse. Attackers modified JavaScript files served through
IncidentOn May 2, 2025, BerriAI released LiteLLM v1.83.14-stable, fixing a vulnerability chain that allowed low-privilege users to execute arbitrary code on the AI gateway server. Obsidian Security disclosed
IncidentWhat Happened Attackers are actively exploiting CVE-2026-5027, a path traversal vulnerability in Langflow that allows arbitrary file writes and remote code execution. The patch shipped in version 1.9.
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn December 18, 2024, the European Commission proposed the Cybersecurity Act 2.0 (CSA 2.0). While intended to enhance security, the regulation introduces a vendor classification mechanism that uses ge
IncidentIncident Overview An open-source project with over 35,000 GitHub stars experienced a full account takeover due to a vulnerability that many security tools would have flagged as low-priority or ignored
IncidentBetween late 2024 and early 2025, Snyk identified eight malicious npm packages that exploited pre- and post-install scripts to execute arbitrary commands on developer machines. Although these packages
IncidentOn a Friday evening in late 2024, websites using OptinMonster began serving malicious JavaScript to visitors. The attack originated from a compromised content delivery network (CDN), not OptinMonster
IncidentWhat Happened Security researchers Mario Stathako and colleagues found that npm s package aliasing feature—intended to let developers install packages under different names—creates a new risk for depe
IncidentThe Threat of IDE Extensions Snyk s security research team discovered remote code execution vulnerabilities in Visual Studio Code extensions available through the official marketplace. A significant e
IncidentWhat Happened Elastic Security Labs has introduced the CI/CD Abuse Detector, an open-source prototype that employs a large language model (LLM) to scan pipeline changes for suspicious activity before
IncidentWhat Happened An authenticated administrator in SuiteCRM could execute arbitrary OS commands through a PHAR deserialization vulnerability. The attack involved uploading a specially crafted PHAR file t
IncidentWhat Happened On February 9, 2021, security researcher Alex Birsan disclosed a dependency confusion attack that compromised build systems at 35 organizations, including major technology companies. The
IncidentWhat Happened On December 9, 2021, security researchers disclosed CVE-2021-44228 , a remote code execution vulnerability in Apache Log4j 2. Known as Log4Shell, it received a CVSS score of 10, indicati
IncidentWhat Happened On December 10, 2021, a critical remote code execution vulnerability in Apache Log4j, identified as CVE-2021-44228, received a CVSS score of 10—the highest severity rating. Known as Log4
IncidentWhat Happened The Federal Trade Commission (FTC) issued a public warning to companies: if you fail to protect consumer data from exposure due to Log4j vulnerabilities, they will pursue legal action. T
