Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams912 Security Engineers1021 Compliance Teams275 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All912 Incident912 General270 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

912 articles in Incident · Clear filtersSort byNewest·Trending

Incident

Latest

5 min read

Three Package Repos Hit in 48 Hours

What Happened Between late 2024 and early 2025, three separate credential-harvesting campaigns targeted npm , PyPI, and Docker Hub within a 48-hour period. These attacks followed a common pattern: com

For Security EngineersRead article

Image Injection Attack Defeats Vision-Language Models

Incident

4 min read

Image Injection Attack Defeats Vision-Language Models

A research team at Xidian University has demonstrated a new type of attack that manipulates multimodal AI systems through altered images. This attack, called CrossMPI, achieved a 66.36% average succes

For Security EngineersRead

Critical NGINX Flaw Exploited Within Days of Disclosure

Incident

5 min read

Critical NGINX Flaw Exploited Within Days of Disclosure

What Happened Between late March and early April 2025, attackers began exploiting CVE-2026-42945 , a critical vulnerability in NGINX that allows denial-of-service attacks and potential remote code exe

For Compliance TeamsRead

NGINX CVE-2026-42945: Exploitation Teardown

Incident

4 min read

NGINX CVE-2026-42945: Exploitation Teardown

What Happened Attackers are actively exploiting CVE-2026-42945 , a heap buffer overflow in NGINX s ngx_http_rewrite_module . VulnCheck detected exploitation attempts against their honeypot networks. T

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Incident

5 min read

AI Flagged 27 Bugs. Only 7 Got Fixed.

What Happened The DARPA Artificial Intelligence Cyber Challenge (AIxCC) concluded with a $30,500,000 prize pool, showcasing AI s potential in vulnerability detection. Seven teams deployed AI systems a

For Security EngineersRead

LLM Code Scanner Generates Working Exploits

Incident

4 min read

LLM Code Scanner Generates Working Exploits

SecureLayer7 released Sandyaa in late 2024 under an MIT license. This tool uses large language models to scan source code for vulnerabilities and then writes exploit code to prove they re real. Within

For Security EngineersRead

Admin Access in 7,400 Attacks: The Burst Statistics Plugin Breach

Incident

5 min read

Admin Access in 7,400 Attacks: The Burst Statistics Plugin Breach

A critical authentication bypass in the Burst Statistics WordPress plugin gave attackers admin-level access to thousands of websites. Here s what happened, which controls failed, and what your team ne

For Security EngineersRead

Expired Domain Hijacks node-ipc Maintainer Account

Incident

3 min read

Expired Domain Hijacks node-ipc Maintainer Account

Incident Overview Attackers compromised the node-ipc npm package by exploiting an expired domain linked to a maintainer s account. They published malicious versions (11.0.0, 11.1.0, and 12.0.0) contai

For Compliance TeamsRead

40,000 WooCommerce Stores Hit by Checkout Skimmer

Incident

4 min read

40,000 WooCommerce Stores Hit by Checkout Skimmer

What Happened Between early December 2024 and January 16, 2025, attackers exploited a critical vulnerability in FunnelKit s Funnel Builder plugin to inject malicious JavaScript into WooCommerce checko

For Security EngineersRead

Microsoft Patched Azure Backup Without a CVE

Incident

4 min read

Microsoft Patched Azure Backup Without a CVE

What Happened On April 13, Microsoft rejected a security researcher s vulnerability report for Azure Backup for AKS (Azure Kubernetes Service). The researcher, Justin O Leary, identified a privilege e

For Compliance TeamsRead

AI Agents Found a 15-Year-Old Bug in 48 Hours

Incident

3 min read

AI Agents Found a 15-Year-Old Bug in 48 Hours

Discovery of a Long-Overlooked Vulnerability An AI-powered security agent uncovered a vulnerability that had eluded human researchers for over a decade, exploiting it within 48 hours of deployment. Th

For Security EngineersRead

Incident

4 min read

Mistral AI Breach: 450 Repos for $25K

What Happened TeamPCP compromised Mistral AI s codebase management system, extracting nearly 450 repositories. They are selling the complete source code for $25,000 on underground forums, threatening

For Security EngineersRead

TanStack Supply Chain Attack: Two Devices, One Pipeline, Total Credential Rotation

Incident

4 min read

TanStack Supply Chain Attack: Two Devices, One Pipeline, Total Credential Rotation

What Happened In early 2025, threat actor TeamPCP compromised TanStack s distribution infrastructure and released trojanized versions of npm and PyPI SDKs. Two OpenAI employee devices installed these

For Security EngineersRead

Credential Theft via Compromised npm Package

Incident

4 min read

Credential Theft via Compromised npm Package

On May 14, 2026, three malicious versions of node-ipc—a package with millions of weekly downloads—were published to npm. These versions (9.1.6, 9.2.3, and 12.0.1) contained a credential-stealing paylo

For Compliance TeamsRead

One Million Sites, Two Flaws, Subscriber Access

Incident

4 min read

One Million Sites, Two Flaws, Subscriber Access

What Happened On May 12, Wordfence disclosed two vulnerabilities in the Avada Builder WordPress plugin, which has an estimated one million active installations. CVE-2026-4782 allows arbitrary file rea

For Security EngineersRead

40,000 Sites Running Vulnerable Checkout Code

Incident

4 min read

40,000 Sites Running Vulnerable Checkout Code

A vulnerability in the Funnel Builder WordPress plugin allowed attackers to inject malicious JavaScript into WooCommerce checkout pages and harvest credit card data in real time. The plugin, active on

For Security EngineersRead

Showing 673-688 of 912 articles

PreviousPage 43 of 57Next