Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams711 Security Engineers765 Compliance Teams225 DevOps Leaders64 Developers31 CISOs17 IT Directors2

Topics:All711 Incident711 General190 Standards88 Research61 Guides36 Deadlines12 Vendor News4 Legal2

711 articles in Incident · Clear filtersSort byNewest·Trending

87% of Production Services Run Exploitable Dependencies

Incident

Latest

3 min read

87% of Production Services Run Exploitable Dependencies

The Problem: Widespread Vulnerabilities According to Datadog s State of DevSecOps 2026 report, 87% of organizations are running at least one exploitable vulnerability in their production services. The

For DevOps LeadersRead article

Incident

3 min read

OAuth Credentials Stored as Executable HTML: The n8n XSS Incident

Overview of the Incident On February 6, n8n released version 2.6.4 to address a stored cross-site scripting (XSS) vulnerability in its handling of OAuth credentials. Security researchers at Imperva fo

For Security EngineersRead

A Threat Intelligence Program That Couldn't Detect Threats

Incident

4 min read

A Threat Intelligence Program That Couldn't Detect Threats

Your security team invested in threat intelligence feeds, built a threat modeling framework, and ran quarterly vulnerability assessments. Yet, an adversary exploited a gap you d documented but never v

For Security EngineersRead

Critical OpenClaw Vulnerability Exposes the Gap Between AI Tool Adoption and Security Readiness

Incident

4 min read

Critical OpenClaw Vulnerability Exposes the Gap Between AI Tool Adoption and Security Readiness

What Happened OpenClaw , an AI-powered development tool widely adopted by developers, recently disclosed and patched a critical vulnerability. This flaw was present in a tool actively integrated into

For DevelopersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

2,863 Google Cloud Keys Became Auth Tokens Without Warning

Incident

5 min read

2,863 Google Cloud Keys Became Auth Tokens Without Warning

What Happened In late 2024, Truffle Security discovered 2,863 live Google Cloud API keys exposed in public repositories. These weren t stolen credentials or phishing victims—they were legitimate billi

For Compliance TeamsRead

When AI Agents Outpaced Every Human Researcher Combined

Incident

3 min read

When AI Agents Outpaced Every Human Researcher Combined

AI s Impact on Vulnerability Discovery In a 90-day period, an AI agent named XBOW submitted over 1,060 valid vulnerabilities to bug bounty programs, surpassing the combined efforts of thousands of hum

For Compliance TeamsRead

Malicious Next.js Repos Triggered Backdoors in VS Code

Incident

4 min read

Malicious Next.js Repos Triggered Backdoors in VS Code

What Happened Microsoft identified a campaign distributing malicious repositories disguised as legitimate Next.js projects. The attack exploited Visual Studio Code s workspace automation features to e

For DevelopersRead

A Calendar Invite Hijacked an AI Browser: The PerplexedComet Breakdown

Incident

5 min read

A Calendar Invite Hijacked an AI Browser: The PerplexedComet Breakdown

What Happened In October 2024, security researchers at Zenity discovered a zero-click vulnerability in Perplexity s Comet AI browser. The flaw, named PerplexedComet, allowed attackers to inject malici

For Compliance TeamsRead

ClawJacked: How a Browser Tab Hijacked an AI Platform Through Localhost

Incident

4 min read

ClawJacked: How a Browser Tab Hijacked an AI Platform Through Localhost

What Happened OpenClaw, a self-hosted AI platform, had a vulnerability that allowed malicious websites to hijack local instances through brute-force password attacks. The attack was simple: a user vis

For Security EngineersRead

Incident

5 min read

3,000 API Keys Found in Public Code: A Google Cloud Incident Analysis

What Happened Truffle Security discovered nearly 3,000 Google Cloud API keys embedded in publicly accessible client-side code. These keys provided unauthorized access to Google s Gemini API endpoints,

For Compliance TeamsRead

Compromised npm Package Installed OpenClaw on 90,000 Weekly Downloads

Incident

4 min read

Compromised npm Package Installed OpenClaw on 90,000 Weekly Downloads

What Happened A threat actor compromised the Cline CLI package on npm and modified it to silently install OpenClaw—an AI coding agent—on developer machines without consent. The malicious version was l

For Compliance TeamsRead

The API Key That Gave Away the Store: An LLM Endpoint Breach Teardown

Incident

5 min read

The API Key That Gave Away the Store: An LLM Endpoint Breach Teardown

What Happened Your development team deployed an internal LLM service with an exposed API endpoint for rapid prototyping. The endpoint used a hardcoded API key with broad permissions to access the orga

For Security EngineersRead

An AI Bot Published a Malicious npm Package for Eight Hours

Incident

4 min read

An AI Bot Published a Malicious npm Package for Eight Hours

On a Tuesday morning, developers running npm update unknowingly downloaded [email protected] — an unauthorized release published without human approval. The package remained live for eight hours, during whi

For Security EngineersRead

The Calendar Invitation That Hijacked an AI Agent

Incident

4 min read

The Calendar Invitation That Hijacked an AI Agent

What Happened Researchers demonstrated a successful promptware attack against Google s AI systems using a simple calendar invitation. The attack began when an AI agent processed a malicious Google Cal

For Security EngineersRead

How Log4j Breaches Still Happen Three Years Later

Incident

4 min read

How Log4j Breaches Still Happen Three Years Later

Persistent Vulnerabilities Log4j vulnerabilities continue to surface in security assessments across production environments in 2024, despite the CVE-2021-44228 disclosure in December 2021. Your team m

For DevelopersRead

When Static Analysis Flagged 847 Vulnerabilities (But Only 3 Were Real)

Incident

4 min read

When Static Analysis Flagged 847 Vulnerabilities (But Only 3 Were Real)

The Problem A mid-sized fintech company s security team spent three weeks triaging 847 vulnerabilities flagged by their static analysis tool during a pre-release audit. After manual investigation, the

For Security EngineersRead

Showing 689-704 of 711 articles

PreviousPage 44 of 45Next