Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened Security researcher Zemnmez discovered a use-of-weak-hash vulnerability in crypto-js and crypto-es, two widely-used JavaScript cryptography libraries. The vulnerability (CVE-2023-46233 f
IncidentWhat Happened On October 11, 2023, the curl project disclosed CVE-2023-38545 , a heap-based buffer overflow in libcurl versions 7.69.0 through 8.3.0. The vulnerability affects the SOCKS5 proxy handsha
IncidentThe Problem Snyk s 2023 State of Open Source Security report highlights a critical issue: 40% of organizations do not use Software Composition Analysis (SCA) or Static Application Security Testing (SA
IncidentWhat Happened On September 11, 2023, CVE-2023-4863 was disclosed with a CVSS score of 9.6. The vulnerability affects libwebp, an image codec library, across versions 0.5.0 through 1.3.1. An attacker c
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn December 7, 2023, the Apache Software Foundation disclosed CVE-2023-50164 , a path traversal vulnerability in Apache Struts with a CVSS score of 9.8. This flaw allows attackers to manipulate file u
IncidentOverview of the Vulnerability A critical vulnerability in WP Maps Pro allowed attackers to create administrator accounts on WordPress sites without authentication. The flaw, tracked as CVE-2026-8732,
IncidentWhat Happened A security researcher demonstrated that npm s default configuration allows malicious packages to exfiltrate macOS keyboard shortcuts through Node.js scripts executed during package insta
IncidentWhat Happened CVE-2024-22195 exposed a cross-site scripting vulnerability in Jinja2, the Python templating library with over 33 million weekly downloads. The flaw existed in all versions prior to 3.1.
IncidentWhat Happened A Chinese company named Funnull acquired the polyfill.io domain and CDN service in February 2024. Soon after, the new owners injected malicious code into the JavaScript files served from
IncidentWhat Happened Three years after Log4Shell was disclosed, 21% of companies still run projects with this critical vulnerability. Spring4Shell fares worse: 35% of companies haven t patched it. This isn t
IncidentWhat Happened FastAPI applications using the python-multipart package were exposed to regular expression denial of service (ReDoS) attacks through CVE-2024-24762. This vulnerability arose from an inse
IncidentYour CI/CD pipeline just pulled a malicious package. The commit shows an AI coding agent added it. The security alert lands on your desk. Who do you hold accountable? AI coding agents are autonomously
IncidentWhat Happened Recently, attackers compromised the npm package @lottiefiles/lottie-player , injecting malicious code to steal cryptocurrency wallet credentials. They released three tainted versions—2.0
IncidentOn December 4, 2024, attackers published malicious versions of Ultralytics, a widely-used Python library for YOLO object detection models, to the Python Package Index (PyPI). The attack exploited GitH
IncidentWhat Happened A typo-squatting attack on the BoltDB Go module was active from November 2021 until January 30, 2025. The malicious package—version 1.3.1 of a forked repository—contained a backdoor that
IncidentThe Challenge of Open Source Security IBM and Red Hat have launched Project Lightwell, a $5 billion initiative involving 20,000 engineers to create a security clearinghouse for open source software. T
