Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams912 Security Engineers1021 Compliance Teams274 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All912 Incident912 General269 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

912 articles in Incident · Clear filtersSort byNewest·Trending

Two KEV Additions, One Lesson: Patch Before Threat Actors Do

Incident

Latest

4 min read

Two KEV Additions, One Lesson: Patch Before Threat Actors Do

What Happened Between May 15 and May 21, 2025, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. CVE-2025-34291, an origin valid

For Security EngineersRead article

Incident

3 min read

Treasury Breach: A 15-Year-Old Flaw

What Happened In December 2024, state-sponsored attackers exploited a PostgreSQL SQL injection zero-day to infiltrate the US Treasury. This vulnerability allowed them to bypass authentication controls

For Security EngineersRead

ChromaDB CVE-2026-45829: Race Condition to RCE

Incident

3 min read

ChromaDB CVE-2026-45829: Race Condition to RCE

Overview of the Vulnerability ChromaDB versions 1.0.0 through 1.5.8 have a critical vulnerability allowing unauthenticated remote code execution. The flaw, tracked as CVE-2026-45829, exploits a race c

For Security EngineersRead

1,467 Malicious AI Skills Found in ClawHub

Incident

5 min read

1,467 Malicious AI Skills Found in ClawHub

An AI agent you deploy to automate customer support queries suddenly starts leaking API keys to an external server. Your incident response team traces it back to a helpful skill you installed three we

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Google's 72 Open-Source Fixes: What CodeMender's Integration Reveals About AI Security Governance

Incident

3 min read

Google's 72 Open-Source Fixes: What CodeMender's Integration Reveals About AI Security Governance

Introduction Google s integration of CodeMender, an AI-powered vulnerability remediation agent, into the Gemini Enterprise Agent Platform marks a strategic shift in AI security governance. This move d

For Security EngineersRead

Next.js Middleware Bypass: CVE-2026-44575

Incident

4 min read

Next.js Middleware Bypass: CVE-2026-44575

What Happened CVE-2026-44575 allows attackers to bypass middleware-based authorization controls in Next.js App Router applications through manipulated request paths. The vulnerability affects Next.js

For Security EngineersRead

Incident

4 min read

3,800 Repos Stolen in 18 Minutes

On May 18, 2026, GitHub disclosed a breach of its internal repositories. The attack vector: a trojanized VS Code extension called Nx Console, maintained by Narwhal Technologies. The compromised versio

For Security EngineersRead

3,800 GitHub Repos Breached via VS Code Extension

Incident

4 min read

3,800 GitHub Repos Breached via VS Code Extension

What Happened Attackers compromised the Nx Console VS Code extension and published a malicious version to the Visual Studio Marketplace. This version exfiltrated authentication tokens from developers

For Security EngineersRead

PolinRider Used Blockchain to Hide Malware in npm Package

Incident

5 min read

PolinRider Used Blockchain to Hide Malware in npm Package

What Happened Between late 2024 and early 2025, attackers compromised two versions of the npm package @common-stack/generate-plugin (9.0.2-alpha.21 and 9.0.2-alpha.22). The package, which sees over 1,

For Security EngineersRead

Drupal CVE-2026-9082: When Anonymous Users Get RCE

Incident

3 min read

Drupal CVE-2026-9082: When Anonymous Users Get RCE

What Happened Drupal recently released emergency security updates for six supported versions to patch CVE-2026-9082 , a vulnerability that allows anonymous users to execute remote code on sites using

For Security EngineersRead

When Equifax Ignored Its Own DAST Findings

Incident

3 min read

When Equifax Ignored Its Own DAST Findings

Equifax s Security Oversight In 2017, Equifax suffered a massive data breach that exposed the personal information of 147 million people. The breach was due to an unpatched Apache Struts vulnerability

For Security EngineersRead

Drupal's CVE-2026-9082: SQL Injection Through the Dependency Stack

Incident

3 min read

Drupal's CVE-2026-9082: SQL Injection Through the Dependency Stack

Overview of the Vulnerability Drupal has released emergency patches for CVE-2026-9082, a critical SQL injection vulnerability affecting sites using PostgreSQL. This issue required coordinated patches

For Security EngineersRead

One Unrotated Token: Grafana's GitHub Breach

Incident

5 min read

One Unrotated Token: Grafana's GitHub Breach

What Happened On May 1, 2025, Grafana detected unauthorized access to its private GitHub repositories. The attacker exploited a single GitHub workflow token that should have been rotated weeks earlier

For Security EngineersRead

Grafana Breach: When npm Supply Chain Attack Met GitHub Tokens

Incident

5 min read

Grafana Breach: When npm Supply Chain Attack Met GitHub Tokens

What Happened On May 11, 2026, Grafana Labs detected unauthorized access to multiple GitHub repositories containing source code and internal information. The entry point was a compromised TanStack npm

For Security EngineersRead

Bitwarden CLI Supply Chain Attack: 90 Minutes of Exposure

Incident

4 min read

Bitwarden CLI Supply Chain Attack: 90 Minutes of Exposure

Incident Overview On April 22, attackers published a malicious version of the Bitwarden CLI package to npm. This compromised package was available for about 90 minutes before it was detected and remov

For Compliance TeamsRead

3,000 Malicious Packages Logged in OSV: Where Your Pipeline Failed

Incident

4 min read

3,000 Malicious Packages Logged in OSV: Where Your Pipeline Failed

The Problem: Undetected Malicious Packages Your dependency scanner missed it. Your code review didn t catch it. A malicious package slipped through your CI/CD pipeline and into production because you

For Security EngineersRead

Showing 641-656 of 912 articles

PreviousPage 41 of 57Next