Expert perspectives on application security, compliance, and emerging threats
GeneralYou ve probably seen the demos: type a single command, watch an AI agent probe your infrastructure, generate exploits, and produce a vulnerability report. Lyrie, the open-source autonomous pentesting
ResearchYour scanner flags 847 vulnerabilities on Monday morning. By Wednesday, your developers have fixed three and opened 23 Slack threads debating the rest. The security team insists everything is critical
IncidentInconsistent Results from LLM Security Reviews Snyk conducted 250 identical security reviews using Claude on the same JavaScript codebase. The outcome was startling: 80 of 161 unique findings appeared
GeneralThe Conventional Wisdom Security teams often treat AI coding agents like advanced code generators. The typical approach: let the agent generate code, then scan the output. This includes static analysi
Get weekly security insights and compliance updates delivered to your inbox.
IncidentA Wake Forest University research team analyzed 444 iOS apps with LLM features and found 282 exposing exploitable credentials. These were plaintext API keys and authentication tokens visible in networ
IncidentThe Problem Between 2023 and 2024, HTTP Archive analyzed 418,112 websites using Google Chrome s Lighthouse auditing tool. The findings revealed that 77% of these sites serve at least one JavaScript li
IncidentWhat Happened On November 27th, security researchers disclosed a high-severity Remote Code Execution vulnerability in EJS, a widely-used JavaScript templating engine. This vulnerability allowed attack
IncidentBetween late 2025 and April 11, 2026, North Korean threat actors published 108 malicious packages and extensions across npm, PyPI, Chrome Web Store, and other platforms as part of the PolinRider campa
ResearchYou are facing a critical decision: whether to allow AI-generated code into production environments. Nearly half of surveyed organizations already run this code in production, while the other half hes
IncidentThe Problem A scan of the top 5,000 websites using WebPageTest and the Snyk vulnerability database found that 76.6% include at least one JavaScript library with a known vulnerability. The most common
IncidentWhat Happened On February 13th, a high-severity prototype override protection bypass vulnerability was discovered in the qs npm package . This package, which parses query strings, recorded nearly 40 m
IncidentWhat Happened On September 7, 2017, Equifax disclosed a breach affecting 143 million people. The attack exploited a vulnerability in Apache Struts , a widely-used open-source web application framework
IncidentWhat Happened The marked package, a popular Markdown parser with over 10 million weekly downloads on npm, shipped with its sanitize option turned off by default. This choice exposed applications proce
IncidentOverview of the Vulnerability Multiple severe vulnerabilities in ImageMagick have been disclosed and are being actively exploited. The imagemagick npm package , which integrates ImageMagick for Node.j
IncidentOn January 11th, the Snyk security research team disclosed XML External Entity (XXE) vulnerabilities in Nokogiri, a widely-used Ruby XML parsing library. Versions prior to 1.5.4 were vulnerable by def
DeadlinesYour team just deployed AI agents to production. They re running on Amazon Bedrock, calling internal APIs, reading configuration files, and making autonomous decisions. When your CISO asks, How do you
