Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams711 Security Engineers765 Compliance Teams225 DevOps Leaders64 Developers31 CISOs17 IT Directors2

Topics:All711 Incident711 General190 Standards88 Research61 Guides36 Deadlines12 Vendor News4 Legal2

711 articles in Incident · Clear filtersSort byNewest·Trending

83,000 Downloads of a Critical Auth Bypass in One Week

Incident

Latest

4 min read

83,000 Downloads of a Critical Auth Bypass in One Week

What Happened On January 15, 2025, researchers disclosed CVE-2026-29000 , a critical authentication bypass vulnerability in pac4j-jwt, a widely-used Java authentication library. The flaw affects the J

For Security EngineersRead article

AI Agent Leaked Customer PII Through Autonomous Email Actions

Incident

5 min read

AI Agent Leaked Customer PII Through Autonomous Email Actions

What Happened Your organization deployed an AI agent with broad permissions to handle customer support inquiries. This agent was set up to autonomously draft and send email responses, access customer

For Security EngineersRead

OAuth2-proxy Authentication Bypass: A Header Smuggling Breakdown

Incident

4 min read

OAuth2-proxy Authentication Bypass: A Header Smuggling Breakdown

A single HTTP header with an underscore instead of a hyphen bypassed authentication for an entire OAuth2-proxy deployment. No brute force. No stolen credentials. Just X_Forwarded_User instead of X-For

For Security EngineersRead

26 Malicious npm Packages: A Supply Chain Attack Breakdown

Incident

4 min read

26 Malicious npm Packages: A Supply Chain Attack Breakdown

What Happened A recent campaign by the North Korean threat actor group Famous Chollima involved the publication of 26 malicious packages to the npm registry. These packages deployed a cross-platform r

For Compliance TeamsRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

1.45 Billion Attacks: How SMBs Became the Primary Target for API Exploits

Incident

4 min read

1.45 Billion Attacks: How SMBs Became the Primary Target for API Exploits

The Surge in API Attacks In the first half of 2025, small and medium-sized businesses (SMBs) faced over 1.45 billion attacks, with API-targeted exploits increasing 74 times compared to previous period

For Compliance TeamsRead

When AI Pentesting Tools Miss What Matters: A Burp AI Case Study

Incident

3 min read

When AI Pentesting Tools Miss What Matters: A Burp AI Case Study

Understanding the Gap in AI Pentesting CyberMaddy, a security researcher, evaluated Burp AI s vulnerability detection capabilities using test web applications. The tool identified common vulnerabiliti

For Security EngineersRead

A Zero-Width Space Character Broke FreeScout's Security

Incident

4 min read

A Zero-Width Space Character Broke FreeScout's Security

What Happened OX Security discovered CVE-2026-28289 , a zero-click remote code execution vulnerability in FreeScout, an open-source helpdesk platform. This flaw allowed attackers to execute arbitrary

For Security EngineersRead

Zero-Day in 1.4 Billion Devices: The Qualcomm CVE-2026-21385 Exploit

Incident

4 min read

Zero-Day in 1.4 Billion Devices: The Qualcomm CVE-2026-21385 Exploit

What Happened Threat actors exploited CVE-2026-21385 , a high-severity memory corruption vulnerability in Qualcomm chipsets, in targeted attacks against Android devices. Security researchers identifie

For Security EngineersRead

Spy-Grade iOS Exploit Kit Now Powering Financial Crime

Incident

4 min read

Spy-Grade iOS Exploit Kit Now Powering Financial Crime

What Happened Between February and late 2025, threat actors deployed Coruna—an iOS exploit kit containing five complete exploit chains and 23 individual exploits—against targets ranging from iPhone mo

For Security EngineersRead

Zero-Click RCE in FreeScout: When Your Help Desk Becomes the Entry Point

Incident

3 min read

Zero-Click RCE in FreeScout: When Your Help Desk Becomes the Entry Point

Overview of the Vulnerability Security researchers at OX Security disclosed CVE-2026-28289 , a critical vulnerability in FreeScout, an open-source, self-hosted help desk platform. This flaw allows una

For Security EngineersRead

When Static Scans Miss the Exploit Path: A Shift-Left Failure

Incident

5 min read

When Static Scans Miss the Exploit Path: A Shift-Left Failure

What Happened Your team might face a critical vulnerability in production that your CI/CD security pipeline had previously scanned and cleared. Consider a SQL injection flaw in a user authentication e

For DevOps LeadersRead

Two Years of AI Infrastructure Exploitation: What Wiz Researchers Found

Incident

3 min read

Two Years of AI Infrastructure Exploitation: What Wiz Researchers Found

Overview of Findings Security researchers at Wiz spent two years examining AI infrastructure deployments to uncover exploitable vulnerabilities. Their findings reveal that while many teams focus on pr

For Security EngineersRead

When Your AI Coding Assistant Becomes an Exfiltration Tool

Incident

4 min read

When Your AI Coding Assistant Becomes an Exfiltration Tool

Incident Overview Orca Security discovered RoguePilot, a vulnerability in GitHub Codespaces that allowed attackers to manipulate GitHub Copilot into leaking GITHUB_TOKEN credentials. Attackers embedde

For Security EngineersRead

A Financial Services Team Discovers Their Load Balancer Is the Weakest Link

Incident

4 min read

A Financial Services Team Discovers Their Load Balancer Is the Weakest Link

The Challenge A financial services organization believed they had a robust security architecture with WAFs , application-layer security controls, runtime protection, and comprehensive monitoring. Howe

For Security EngineersRead

OAuth Error Flow Attacks Hit Government Networks: A Technical Breakdown

Incident

4 min read

OAuth Error Flow Attacks Hit Government Networks: A Technical Breakdown

Attack Overview Attackers have targeted government and public-sector organizations by exploiting OAuth 2.0 s error handling mechanisms. The attack began with phishing emails containing malicious links

For Security EngineersRead

4,000 Downloads in Eight Hours: Anatomy of the Cline CLI Supply Chain Attack

Incident

5 min read

4,000 Downloads in Eight Hours: Anatomy of the Cline CLI Supply Chain Attack

What Happened On February 17, 2026, an attacker exploited a compromised npm publish token to release Cline CLI version 2.3.0, an unauthorized update that installed OpenClaw on developer systems. This

For Security EngineersRead

Showing 673-688 of 711 articles

PreviousPage 43 of 45Next