Expert perspectives on application security, compliance, and emerging threats
IncidentOverview of the Vulnerability A critical vulnerability in WP Maps Pro allowed attackers to create administrator accounts on WordPress sites without authentication. The flaw, tracked as CVE-2026-8732,
IncidentWhat Happened A security researcher demonstrated that npm s default configuration allows malicious packages to exfiltrate macOS keyboard shortcuts through Node.js scripts executed during package insta
IncidentWhat Happened CVE-2024-22195 exposed a cross-site scripting vulnerability in Jinja2, the Python templating library with over 33 million weekly downloads. The flaw existed in all versions prior to 3.1.
GeneralUnderstanding the Risk The npm package strip-ansi-cjs appears in your dependency tree with 529 dependents and 7,274 weekly downloads, yet it s completely empty. This is not just a theoretical risk—it
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened A Chinese company named Funnull acquired the polyfill.io domain and CDN service in February 2024. Soon after, the new owners injected malicious code into the JavaScript files served from
IncidentWhat Happened Three years after Log4Shell was disclosed, 21% of companies still run projects with this critical vulnerability. Spring4Shell fares worse: 35% of companies haven t patched it. This isn t
IncidentWhat Happened FastAPI applications using the python-multipart package were exposed to regular expression denial of service (ReDoS) attacks through CVE-2024-24762. This vulnerability arose from an inse
IncidentYour CI/CD pipeline just pulled a malicious package. The commit shows an AI coding agent added it. The security alert lands on your desk. Who do you hold accountable? AI coding agents are autonomously
IncidentWhat Happened Recently, attackers compromised the npm package @lottiefiles/lottie-player , injecting malicious code to steal cryptocurrency wallet credentials. They released three tainted versions—2.0
IncidentOn December 4, 2024, attackers published malicious versions of Ultralytics, a widely-used Python library for YOLO object detection models, to the Python Package Index (PyPI). The attack exploited GitH
IncidentWhat Happened A typo-squatting attack on the BoltDB Go module was active from November 2021 until January 30, 2025. The malicious package—version 1.3.1 of a forked repository—contained a backdoor that
IncidentThe Challenge of Open Source Security IBM and Red Hat have launched Project Lightwell, a $5 billion initiative involving 20,000 engineers to create a security clearinghouse for open source software. T
GeneralThe Conventional Wisdom Security teams are delaying agentic AI deployments until purpose-built security tools mature. This seems prudent: the tools for safely adopting agentic AI frameworks are just e
GeneralYour AI service just returned an empty response. No error code. No stack trace. The model simply decided not to answer. Traditional debugging assumes deterministic behavior — same input, same output.
IncidentWhat Happened In early 2024, an attacker with write access to the tj-actions/changed-files repository modified the GitHub Action to expose encrypted secrets in plaintext within workflow logs. This Act
IncidentWhat Happened A critical remote code execution vulnerability in Gogs , a self-hosted Git service, remains unpatched more than two months after Rapid7 reported it to the project maintainer. The vulnera
