Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams711 Security Engineers765 Compliance Teams225 DevOps Leaders64 Developers31 CISOs17 IT Directors2

Topics:All711 Incident711 General190 Standards88 Research61 Guides36 Deadlines12 Vendor News4 Legal2

711 articles in Incident · Clear filtersSort byNewest·Trending

When a Fintech Vendor Gets Ransomware, 672,000 People Pay the Price

Incident

Latest

3 min read

When a Fintech Vendor Gets Ransomware, 672,000 People Pay the Price

What Happened Marquis, a fintech company serving financial institutions, suffered a ransomware attack that exposed personal information for at least 672,075 individuals. The attackers bypassed direct

For Security EngineersRead article

A Single Git Push Could Have Compromised GitHub's Entire Backend

Incident

3 min read

A Single Git Push Could Have Compromised GitHub's Entire Backend

What Happened In late 2024, security researchers at Wiz discovered CVE-2026-3854, a remote code execution vulnerability in GitHub s infrastructure. This flaw allowed attackers to execute arbitrary cod

For Security EngineersRead

Cursor IDE Vulnerability: When AI Agents Execute Malicious Git Hooks

Incident

4 min read

Cursor IDE Vulnerability: When AI Agents Execute Malicious Git Hooks

Overview of the Vulnerability A critical vulnerability in Cursor IDE allowed attackers to execute arbitrary code through Git operations performed by the IDE s AI agent. This flaw, tracked as CVE-2026-

For Security EngineersRead

Unsafe Deserialization Takes Down Robotics Platform: The LeRobot CVE-2026-25874 Breakdown

Incident

4 min read

Unsafe Deserialization Takes Down Robotics Platform: The LeRobot CVE-2026-25874 Breakdown

A critical vulnerability in Hugging Face s LeRobot platform highlights the overlooked risks of using unsafe serialization formats in open-source projects. CVE-2026-25874, scoring 9.3 on CVSS, allows u

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

73 Malicious Extensions Sat Dormant in OpenVSX for Months

Incident

5 min read

73 Malicious Extensions Sat Dormant in OpenVSX for Months

What Happened Between late 2024 and early 2025, attackers planted 73 malicious extensions in the OpenVSX registry—an open-source alternative to the Visual Studio Code Marketplace. These extensions app

For Security EngineersRead

PyPI's elementary-data Breach: When CI/CD Becomes the Attack Surface

Incident

4 min read

PyPI's elementary-data Breach: When CI/CD Becomes the Attack Surface

What Happened The elementary-data package on PyPI, downloaded over 1.1 million times monthly, was compromised to distribute version 0.23.3 containing malware designed to steal sensitive data and crypt

For DevOps LeadersRead

Microsoft's Agent ID Administrator Flaw: A Privilege Escalation Teardown

Incident

5 min read

Microsoft's Agent ID Administrator Flaw: A Privilege Escalation Teardown

What Happened Microsoft s Entra ID (formerly Azure AD) had a role misconfiguration that allowed the Agent ID Administrator role to escalate privileges beyond its intended scope. Designed to manage aut

For Security EngineersRead

Checkmarx GitHub Repository Breach: What Happened and How to Prevent It

Incident

3 min read

Checkmarx GitHub Repository Breach: What Happened and How to Prevent It

On March 23, 2026, Checkmarx—a company specializing in application security testing tools—experienced a supply chain attack on their GitHub repository. Data from this repository later surfaced on the

For Security EngineersRead

Cryptominers Exploited Two Auth Bypass Flaws in Qinglong's Middleware

Incident

4 min read

Cryptominers Exploited Two Auth Bypass Flaws in Qinglong's Middleware

Incident Overview On February 27, 2026, researchers disclosed two authentication bypass vulnerabilities in Qinglong, an open-source task scheduler with over 19,000 GitHub stars. CVE-2026-3965 and CVE-

For Security EngineersRead

When AI Found 10,000 Vulnerabilities in Your Codebase and Your Team Had Capacity for 200

Incident

4 min read

When AI Found 10,000 Vulnerabilities in Your Codebase and Your Team Had Capacity for 200

The Challenge of AI-Driven Vulnerability Discovery On April 7, Anthropic released Claude Mythos Preview, an AI system designed to identify security vulnerabilities at scale. This tool promised to scan

For Compliance TeamsRead

20 Hours: The Langflow RCE Exploit Timeline

Incident

4 min read

20 Hours: The Langflow RCE Exploit Timeline

What Happened A critical remote code execution vulnerability in Langflow—an open-source tool for building AI pipelines—was exploited in the wild within 20 hours of public disclosure. The vulnerability

For Security EngineersRead

Google Cloud Vertex AI Permissions Flaw: When Default Service Agents Become Data Exfiltration Paths

Incident

4 min read

Google Cloud Vertex AI Permissions Flaw: When Default Service Agents Become Data Exfiltration Paths

Overview of the Vulnerability Unit 42 researchers have identified a vulnerability in Google Cloud Vertex AI s permission model. This flaw allows attackers with compromised credentials to escalate priv

For Compliance TeamsRead

Axios npm Package Compromised: A Two-Hour Window That Could Have Wrecked Your Pipeline

Incident

4 min read

Axios npm Package Compromised: A Two-Hour Window That Could Have Wrecked Your Pipeline

What Happened On March 31, 2026, malicious versions of the axios npm package (1.14.1 and 0.30.4) were published to the npm registry using a compromised maintainer account (@jasonsaayman). The attacker

For Compliance TeamsRead

Axios npm Hijack: When 18 Hours of Prep Time Beat Your Dependency Checks

Incident

3 min read

Axios npm Hijack: When 18 Hours of Prep Time Beat Your Dependency Checks

What Happened Recently, attackers published two malicious versions of Axios—the npm HTTP client used by millions of JavaScript applications. Versions 1.14.1 and 0.30.4 introduced a dependency called p

For Compliance TeamsRead

Cisco Lost 300+ Repositories to a Malicious GitHub Action

Incident

4 min read

Cisco Lost 300+ Repositories to a Malicious GitHub Action

What Happened Cisco s development environment was compromised when attackers used credentials stolen from a supply chain attack on Trivy, an open-source vulnerability scanner. The threat group TeamPCP

For Compliance TeamsRead

Two OpenAI Vulnerabilities Expose the Input Validation Gap in AI Tools

Incident

5 min read

Two OpenAI Vulnerabilities Expose the Input Validation Gap in AI Tools

What Happened OpenAI recently patched two vulnerabilities in its AI products that could have enabled unauthorized data movement. The first, discovered by BeyondTrust researchers, affected Codex: a com

For Security EngineersRead

Showing 593-608 of 711 articles

PreviousPage 38 of 45Next