Expert perspectives on application security, compliance, and emerging threats
IncidentIncident Overview The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-21182 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch Oracle WebLogic S
GeneralYour team likely runs static analysis on code after it s committed, scans containers before deployment, and uses software composition analysis to track known CVEs in your dependencies. However, if you
IncidentWhat Happened Between April and May 2026, attackers compromised Red Hat s GitHub credentials and injected malicious code into npm packages maintained by the company. The malware, dubbed Miasma: The Sp
IncidentUnderstanding the Vulnerability CVE-2022-31692 revealed a critical flaw in Spring Security versions 5.6.x through 5.7.4, scoring 9.8 on the National Vulnerability Database. Applications using RegexReq
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened On January 4, CircleCI discovered unauthorized access to their systems and immediately advised all customers to rotate their secrets. The company invalidated Personal and Project API tok
IncidentWhat Happened Obsidian Security disclosed CVE-2026-40933, a critical remote code execution vulnerability in Flowise s Model Context Protocol (MCP) stdio server implementation. The vulnerability has a
IncidentWhat Happened A malicious npm package named codexui-android infiltrated the supply chain of OpenAI Codex users, exfiltrating authentication tokens to an attacker-controlled server at sentry.anyclaw[.]
IncidentWhat Happened On September 7, 2017, Equifax disclosed a breach that exposed personal information of 147 million people. The attack exploited CVE-2017-5638 , a remote code execution vulnerability in Ap
IncidentWhat Happened CVE-2022-1471 exposed a critical flaw in SnakeYaml s Constructor class, allowing arbitrary code execution through unsafe deserialization. This vulnerability affects the org.yaml:snakeyam
IncidentWhat Happened Security researcher Zemnmez discovered a use-of-weak-hash vulnerability in crypto-js and crypto-es, two widely-used JavaScript cryptography libraries. The vulnerability (CVE-2023-46233 f
GuidesPurpose of the Template Your dependency management policy must be robust to prevent the next supply chain incident from affecting your production environment. This template establishes governance cont
IncidentWhat Happened On October 11, 2023, the curl project disclosed CVE-2023-38545 , a heap-based buffer overflow in libcurl versions 7.69.0 through 8.3.0. The vulnerability affects the SOCKS5 proxy handsha
DeadlinesThe Executive Order on AI Safety, issued on October 30 by President Biden, isn t legally binding. Compliance teams often use this fact to justify inaction. However, this EO signals future regulatory d
IncidentThe Problem Snyk s 2023 State of Open Source Security report highlights a critical issue: 40% of organizations do not use Software Composition Analysis (SCA) or Static Application Security Testing (SA
IncidentWhat Happened On September 11, 2023, CVE-2023-4863 was disclosed with a CVSS score of 9.6. The vulnerability affects libwebp, an image codec library, across versions 0.5.0 through 1.3.1. An attacker c
IncidentOn December 7, 2023, the Apache Software Foundation disclosed CVE-2023-50164 , a path traversal vulnerability in Apache Struts with a CVSS score of 9.8. This flaw allows attackers to manipulate file u
