Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened In early 2025, HackerOne paused its bug bounty program due to an overwhelming increase in vulnerability discoveries, driven by AI-assisted research. This wasn t a breach or technical fai
IncidentOn February 28, 2025, security researchers at Endor Labs discovered that attackers had published malicious versions of popular JavaScript packages—including TanStack Query and Mistral AI s SDK—using s
IncidentWhat Happened RubyGems temporarily stopped new account creation after detecting hundreds of malicious packages uploaded to its registry. The attack involved multiple newly created accounts uploading p
IncidentWhat Happened JetBrains disclosed CVE-2026-44413 , a high-severity vulnerability in TeamCity On-Premises versions 2025.11.4 and earlier. This flaw enables privilege escalation and may expose sensitive
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Between late 2024 and early 2025, threat actor TeamPCP executed a supply chain attack that compromised over 170 npm and PyPI packages with more than 518 million downloads. The attack, as
IncidentIn 2024, the TeamPCP threat group executed a supply chain attack compromising 170 npm and PyPI packages, including key dependencies like the TanStack Router ecosystem and Mistral AI SDK. The attack ex
IncidentThe Emerging Threat This isn t a traditional incident analysis because there isn t a specific breach to dissect. Instead, a new pattern is emerging in threat intelligence: adversaries are using large
IncidentWhat Happened In early 2025, security researchers at Knostic discovered 1,862 Model Context Protocol (MCP) servers exposed to the public internet without any authentication controls. These servers all
IncidentGoogle s Threat Intelligence Group has disclosed a new threat your security program wasn t designed to handle: a working exploit developed entirely by AI. This vulnerability—a 2FA bypass implemented i
IncidentGoogle s Threat Intelligence Group has documented a zero-day exploit that shows signs of AI-assisted development. This exploit was deployed by a criminal group against a popular open-source web-based
IncidentOn May 9, 2026, Checkmarx published a malicious version of its Jenkins AST plugin to the public Jenkins plugin repository. This compromised version was designed to exfiltrate user credentials and pote
IncidentWhat Happened Cyera disclosed a critical heap out-of-bounds read vulnerability in Ollama, a popular open-source framework for running large language models locally. The flaw, tracked as CVE-2026-7482
IncidentWhat Happened Intruder s security team scanned over 1 million exposed AI services across the public internet, uncovering widespread security failures in AI infrastructure. The scan revealed that 31% o
IncidentSummary of the Incident Between late February and early March 2026, attackers published five malicious Rust crates to crates.io disguised as time utility libraries. These packages executed code during
IncidentWhat Happened On March 23, 2026, malicious artifacts were published through a compromised Checkmarx GitHub repository. Seven days later, on March 30, attackers exfiltrated data from systems that had c
IncidentYou re building an AI coding agent using GitHub s MCP Server. Your agent needs database credentials to run queries, so you hardcode them in the server configuration. Within hours, those credentials ar
