Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams711 Security Engineers765 Compliance Teams225 DevOps Leaders64 Developers31 CISOs17 IT Directors2

Topics:All711 Incident711 General190 Standards88 Research61 Guides36 Deadlines12 Vendor News4 Legal2

711 articles in Incident · Clear filtersSort byNewest·Trending

Incident

Latest

4 min read

Zero-Day Built by AI: What Went Wrong

Google s Threat Intelligence Group has documented a zero-day exploit that shows signs of AI-assisted development. This exploit was deployed by a criminal group against a popular open-source web-based

For Security EngineersRead article

Checkmarx Plugin Compromise: Anatomy of a CI/CD Supply Chain Attack

Incident

4 min read

Checkmarx Plugin Compromise: Anatomy of a CI/CD Supply Chain Attack

On May 9, 2026, Checkmarx published a malicious version of its Jenkins AST plugin to the public Jenkins plugin repository. This compromised version was designed to exfiltrate user credentials and pote

For DevOps LeadersRead

Ollama CVE-2026-7482: Memory Leak Hits 300,000 Servers

Incident

5 min read

Ollama CVE-2026-7482: Memory Leak Hits 300,000 Servers

What Happened Cyera disclosed a critical heap out-of-bounds read vulnerability in Ollama, a popular open-source framework for running large language models locally. The flaw, tracked as CVE-2026-7482

For Compliance TeamsRead

1.6M Ollama Servers Found Running Without Auth

Incident

4 min read

1.6M Ollama Servers Found Running Without Auth

What Happened Intruder s security team scanned over 1 million exposed AI services across the public internet, uncovering widespread security failures in AI infrastructure. The scan revealed that 31% o

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Five Malicious Rust Crates Steal Secrets from CI/CD

Incident

3 min read

Five Malicious Rust Crates Steal Secrets from CI/CD

Summary of the Incident Between late February and early March 2026, attackers published five malicious Rust crates to crates.io disguised as time utility libraries. These packages executed code during

For Security EngineersRead

Checkmarx Repository Compromise: Seven Days from Publish to Exfiltration

Incident

5 min read

Checkmarx Repository Compromise: Seven Days from Publish to Exfiltration

What Happened On March 23, 2026, malicious artifacts were published through a compromised Checkmarx GitHub repository. Seven days later, on March 30, attackers exfiltrated data from systems that had c

For Compliance TeamsRead

Incident

5 min read

Secret Leaked in MCP Server Config File

You re building an AI coding agent using GitHub s MCP Server. Your agent needs database credentials to run queries, so you hardcode them in the server configuration. Within hours, those credentials ar

For Security EngineersRead

n8n Sandbox Escape: CVE-2026-27577 Teardown

Incident

5 min read

n8n Sandbox Escape: CVE-2026-27577 Teardown

A contact form shouldn t give an attacker root access to your automation server. But in n8n versions prior to 2.10.1, that s exactly what could happen. Let s walk through how CVE-2026-27577 and CVE-20

For Security EngineersRead

Incident

4 min read

300,000 Ollama Servers Leaked Memory

On March 17, 2025, security researchers at Cyera disclosed CVE-2026-7482 , a critical vulnerability in Ollama that allowed attackers to extract arbitrary memory contents from running AI models. The fl

For Security EngineersRead

Incident

4 min read

Stolen Token to AWS Admin in 72 Hours

What Happened In August 2025, threat actor UNC6426 compromised the nx npm package, gaining full AWS administrator access within 72 hours. The attack began with a vulnerable pull_request_target workflo

For Security EngineersRead

MetInfo CMS Patch Ignored for 24 Days, Then Exploited

Incident

4 min read

MetInfo CMS Patch Ignored for 24 Days, Then Exploited

On May 1, 2026, attackers began exploiting CVE-2026-29014 , a PHP code injection vulnerability in MetInfo CMS with a CVSS score of 9.8. This flaw allows unauthenticated remote code execution, giving a

For Security EngineersRead

Mozilla Ships 271 AI-Found Bugs in One Release

Incident

3 min read

Mozilla Ships 271 AI-Found Bugs in One Release

What Happened In the Firefox 150 release, Mozilla disclosed 271 vulnerabilities discovered by Anthropic s Mythos AI model. This was a controlled discovery process, not a breach, revealing flaws in cod

For Security EngineersRead

Incident

3 min read

AI Pentests Show 32% High-Risk Findings

The Security Gap in AI Systems Cobalt s State of Pentesting Report highlights a significant gap between AI system security and traditional application security. When pentesters examined AI and LLM imp

For Security EngineersRead

Apache HTTP/2 Double-Free: When Default Settings Become Attack Surface

Incident

4 min read

Apache HTTP/2 Double-Free: When Default Settings Become Attack Surface

What Happened Apache HTTP Server version 2.4.66 contained a double-free vulnerability in its HTTP/2 protocol handling code (CVE-2026-23918). Discovered by Bartlomiej Dmitruk and colleagues, this flaw

For Security EngineersRead

454,600 Malicious Packages: The Axios Dependency Attack

Incident

4 min read

454,600 Malicious Packages: The Axios Dependency Attack

What Happened In 2025, attackers compromised the axios JavaScript package—one of the most widely used HTTP client libraries in the Node.js ecosystem—through a malicious transitive dependency. The atta

For Security EngineersRead

Trojanized DAEMON Tools: When Your Installer Becomes the Attack Vector

Incident

4 min read

Trojanized DAEMON Tools: When Your Installer Becomes the Attack Vector

On April 8, attackers compromised DAEMON Tools distribution infrastructure and replaced legitimate installers with trojanized versions. The attack continued through at least mid-April, affecting versi

For Compliance TeamsRead

Showing 513-528 of 711 articles

PreviousPage 33 of 45Next