Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened In early 2025, security researchers at Cyera disclosed multiple vulnerabilities in protobuf.js, the JavaScript implementation of Google s Protocol Buffers serialization library. The most
IncidentBetween late 2024 and early 2025, attackers compromised 37 wheel distributions and 19 source packages on the Python Package Index (PyPI) . This campaign, known as Hades, represents a tactical evolutio
IncidentWhat Happened Socket discovered 19 compromised packages on PyPI, downloaded hundreds of thousands of times, delivering malware designed to steal developer credentials. These packages targeted scientif
IncidentWhat Happened Microsoft has introduced a two-hour automatic update delay for Visual Studio Code extensions to mitigate supply chain attack risks. This delay applies to all third-party extensions excep
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn May 1, 2022, npm removed a malicious package called gxm-reference-web-auth-server from the public registry. This targeted attack used encryption and multi-stage obfuscation to hide data exfiltratio
IncidentSnyk discovered 12 malicious packages in the Python Package Index (PyPI) that stole Discord tokens, Roblox credentials, and payment card data. The attackers used Discord s content delivery network (CD
IncidentWhat Happened Snyk s security research team discovered over 200 malicious packages in the npm registry, exploiting dependency confusion attacks to deliver Cobalt Strike payloads. These packages used i
IncidentWhat Happened CVE-2022-33980 allowed attackers to execute arbitrary code through Apache Commons Configuration s string interpolation feature. The vulnerability affected versions 2.4 through 2.7 and st
IncidentWhat Happened Between April 13 and April 15, attackers exploited CVE-2026-3300 , a critical vulnerability in the Everest Forms Pro WordPress plugin, to create rogue administrator accounts on vulnerabl
IncidentA developer on your team merges a routine dependency update. The diff shows a few version bumps in Gemfile.lock . Your CI passes. The code deploys. Three days later, your build server is mining crypto
IncidentWhat Happened In mid-2026, the Miasma worm—a variant of Mini Shai-Hulud—compromised 73 Microsoft GitHub repositories. This attack didn t exploit a traditional vulnerability but instead manipulated the
IncidentWhat Happened On September 29, 2022, Snyk disclosed CVE-2022-40764, a command injection vulnerability in their CLI tool that allowed arbitrary code execution. This flaw affected all versions before 1.
IncidentWhat Happened OpenAI didn t suffer a data breach. Instead, they acknowledged a fundamental architectural risk: ChatGPT s features create multiple pathways for prompt injection attacks to exfiltrate da
IncidentThe Discovery GitGuardian s analysis revealed an average of 150 secrets per developer machine. These secrets weren t found in repositories or CI/CD logs but on local workstations — hidden in shell his
IncidentSummary of the Incident A single unpatched VPN vulnerability in Marquis Software s platform compromised over seventy financial institutions. This vulnerability was present in the production infrastruc
IncidentIMPORTANT NOTICE : This teardown analyzes a hypothetical scenario based on researcher predictions about AI worm capabilities. As of this writing, no documented enterprise breach by an autonomous AI wo
