Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams711 Security Engineers765 Compliance Teams225 DevOps Leaders64 Developers31 CISOs17 IT Directors2

Topics:All711 Incident711 General190 Standards88 Research61 Guides36 Deadlines12 Vendor News4 Legal2

711 articles in Incident · Clear filtersSort byNewest·Trending

350 GB Stolen Through a Vulnerability Scanner: The Europa.eu Supply Chain Breach

What Happened CERT-EU confirmed that 350 GB of data was stolen from Europa.eu, the European Commission s web platform. The stolen data included personal names, email addresses, and internal messages f

For Compliance TeamsRead article

Incident

North Korean Hackers Compromised Axios npm Packages for Under Three Hours

What Happened For a brief period, attackers published backdoored versions of Axios to npm . Axios is an HTTP client library downloaded millions of times weekly. The malicious packages contained code t

For Compliance TeamsRead

Incident

Axios NPM Package Breach: When 9 Million Weekly Downloads Meet a Sophisticated Compromise

What Happened The NPM package for Axios was briefly compromised this week. Axios is a JavaScript HTTP client library with approximately 9 million weekly downloads, making it one of the most widely use

For DevelopersRead

Incident

Axios Attack: 300 Million Weekly Downloads, Minutes to Detect

On March 31, 2026, attackers published malicious versions of axios—one of the most widely used HTTP client libraries in the JavaScript ecosystem. The compromised packages contained hidden dependencies

For Compliance TeamsRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Incident

Axios Supply Chain Attack: When Account Compromise Hits 100 Million Weekly Downloads

What Happened Attackers compromised the npm account of Axios lead maintainer and published malicious versions of the library containing a remote access trojan. Axios, a widely-used HTTP client library

For Compliance TeamsRead

Incident

Axios Supply Chain Attack: How 300 Million Weekly Downloads Nearly Became a Backdoor

What Happened On March 31, 2026, attackers published malicious versions of axios —a JavaScript HTTP client library with over 300 million weekly downloads—to the npm registry. The compromised packages

For Compliance TeamsRead

Google's Antigravity Tool: When Prompt Injection Becomes Remote Code Execution

Incident

4 min read

Google's Antigravity Tool: When Prompt Injection Becomes Remote Code Execution

What Happened Google patched a critical remote code execution vulnerability in Antigravity, an internal AI-based tool. The flaw arose from a prompt-injection vulnerability that allowed attackers to es

For Security EngineersRead

6,500 Unpatched ActiveMQ Instances: When AI Finds Flaws Faster Than You Can Fix Them

Incident

3 min read

6,500 Unpatched ActiveMQ Instances: When AI Finds Flaws Faster Than You Can Fix Them

Summary of the Incident A critical remote code execution vulnerability in Apache ActiveMQ was discovered using AI-assisted analysis in about 10 minutes. This vulnerability affects versions before 5.19

For Compliance TeamsRead

13 Hours: An SSRF Vulnerability Goes from Disclosure to Active Exploitation

Incident

4 min read

13 Hours: An SSRF Vulnerability Goes from Disclosure to Active Exploitation

What Happened When CVE-2026-33626 was disclosed, attackers quickly began exploiting a server-side request forgery (SSRF) vulnerability in LMDeploy, an open-source toolkit for deploying large language

For Security EngineersRead

Bitwarden CLI Supply Chain Attack: A 95-Minute Window That Exposed Thousands of Secrets

Incident

5 min read

Bitwarden CLI Supply Chain Attack: A 95-Minute Window That Exposed Thousands of Secrets

What Happened On April 22, 2026, attackers published a compromised version of the Bitwarden command-line interface (version @bitwarden/ [email protected] ) to npm. The malicious code, embedded in a file na

For Compliance TeamsRead

Bitwarden CLI Hijacked for 90 Minutes: A CI/CD Pipeline Breach Teardown

Incident

4 min read

Bitwarden CLI Hijacked for 90 Minutes: A CI/CD Pipeline Breach Teardown

On April 22, 2025, developers who updated the Bitwarden CLI to version 2026.4.0 installed malware designed to exfiltrate their most sensitive credentials. The window was narrow—just over 90 minutes—bu

For Compliance TeamsRead

Bitwarden CLI Package Breach: How a Compromised GitHub Action Stole Developer Credentials

Incident

4 min read

Bitwarden CLI Package Breach: How a Compromised GitHub Action Stole Developer Credentials

What Happened On April 22, 2026, the @bitwarden/cli npm package was compromised with malicious code aiming to steal developer credentials. This package was available from 5:57 PM to 7:30 PM ET. During

For Security EngineersRead

Hackers Compromised a Security Tool to Steal the Secrets It Was Scanning

Incident

5 min read

Hackers Compromised a Security Tool to Steal the Secrets It Was Scanning

What Happened On April 22, 2026, attackers replaced legitimate Docker images of Checkmarx s KICS (Keeping Infrastructure as Code Secure) tool with malicious versions. KICS is an open-source scanner th

For Compliance TeamsRead

A 9.3 CVSS Vulnerability That Will Never Be Patched

Incident

5 min read

A 9.3 CVSS Vulnerability That Will Never Be Patched

What Happened CVE-2026-5752, a critical vulnerability in Cohere AI s Terrarium sandbox, allows attackers to execute arbitrary code with root privileges and escape container isolation. This flaw exploi

For Security EngineersRead

16 npm Packages Compromised in Self-Propagating Supply Chain Attack

Incident

4 min read

16 npm Packages Compromised in Self-Propagating Supply Chain Attack

What Happened On April 21, 2025, attackers published a malicious version of the pgserve package from Namastex Labs. Within days, 16 packages from the same publisher were compromised. The attack used a

For DevelopersRead

An Attacker Executed Code Through Your AI Agent and You Never Saw It

Incident

4 min read

An Attacker Executed Code Through Your AI Agent and You Never Saw It

Understanding the Vulnerability OX Security disclosed a critical vulnerability in Anthropic s Model Context Protocol (MCP) SDK that enables remote code execution across Python, TypeScript, Java, and R

For Security EngineersRead

Showing 625-640 of 711 articles

PreviousPage 40 of 45Next