Expert perspectives on application security, compliance, and emerging threats
ResearchThese myths persist because they allow teams to avoid uncomfortable conversations about accountability. When your auditor asks who owns security for the 247 open source packages in your application, p
IncidentUnderstanding the Vulnerability Snyk s security team has disclosed a path traversal vulnerability affecting archive extraction libraries across multiple ecosystems. Known as Zip Slip, this vulnerabili
IncidentOn March 15, 2025, security researchers detected active exploitation of CVE-2026-33017, a critical remote code execution vulnerability in Langflow, a popular low-code framework for building AI workflo
IncidentOn November 26, 2018, security researchers discovered that event-stream —a widely-used npm package downloaded roughly 2 million times per week—had been compromised. The malicious code, hidden in a dep
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened In early 2018, Snyk s security research team discovered a directory traversal vulnerability in archive extraction code affecting thousands of projects across multiple ecosystems. The vul
GeneralWhen you review a Pull Request, you re looking at changed files. Your SAST tool scans those files. Your IDE highlights issues in the file you have open. But the SQL injection vulnerability? It starts
GeneralThe Conventional Wisdom Your security team runs dependency scanners in CI/CD. You ve configured Dependabot, Snyk, or another tool. When a pull request comes in, the scanner checks for known vulnerabil
IncidentWhat Happened Between 2016 and 2017, the number of published vulnerabilities across tracked open-source ecosystems jumped 83 percent. The npm and Maven Central repositories — essential for JavaScript
IncidentWhat Happened In September 2018, the maintainer of event-stream —an npm package downloaded 2 million times per week—transferred ownership to a new contributor after months of social engineering. Withi
IncidentWhat Happened In 2024, the National Institute of Standards and Technology (NIST) s National Vulnerability Database (NVD) reduced its CVE enrichment operations, analyzing fewer vulnerabilities in depth
IncidentWhat Happened Attackers are exploiting CVE-2026-45659 , a remote code execution vulnerability in Microsoft SharePoint. This flaw allows an authenticated user with low privileges to execute arbitrary c
IncidentWhat Happened On December 3, 2018, the Kubernetes security team disclosed CVE-2018-1002105 , a critical vulnerability that allowed any authenticated user to escalate privileges and execute arbitrary c
ResearchYour endpoint detection just blocked another phishing email. Your web proxy flagged a suspicious download. But ClickFix attacks don t look like traditional malware delivery—they mimic legitimate troub
IncidentWhat Happened Microsoft SharePoint Server contains a deserialization vulnerability (CVE-2026-45659, CVSS 8.8) that allows authenticated attackers to execute arbitrary code remotely. CISA added this vu
GeneralScope This guide focuses on modifying CI/CD pipelines for deploying large language models (LLMs) to production. If your team is running LLM-powered features like chatbots or content generators, your c
IncidentWhat Happened Security researchers at Synacktiv have disclosed a vulnerability in Argo CD s repo-server component that allows code execution and deployment manipulation within Kubernetes clusters. As
