Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1105 Security Engineers765 Compliance Teams225 DevOps Leaders64 Developers31 CISOs17 IT Directors2

Topics:All1105 Incident711 General190 Standards88 Research61 Guides36 Deadlines12 Vendor News4 Legal2

1105 articlesSort byNewest·Trending

Checkmarx Jenkins Plugin Hacked Twice in Three Weeks

Incident

Latest

4 min read

Checkmarx Jenkins Plugin Hacked Twice in Three Weeks

What Happened TeamPCP compromised the Checkmarx Jenkins AST plugin in a second supply chain attack, using credentials obtained from an earlier breach. The attackers gained write access to the plugin s

For Compliance TeamsRead article

Jenkins Plugin Hijack Exposes CI/CD Credential Chain

Incident

5 min read

Jenkins Plugin Hijack Exposes CI/CD Credential Chain

What Happened On May 9, 2026, TeamPCP published a compromised version of the Checkmarx Jenkins AST plugin to the official Jenkins Marketplace. This malicious plugin contained info-stealing malware, ex

For Security EngineersRead

General

4 min read

AI SBOMs Won't Fix Your AI Risk Problem

The belief that documenting AI components will control AI risk is widespread. CISA and the G7 have released guidance for AI software bills of materials (SBOMs), and the compliance world is treating it

For Compliance TeamsRead

Two Critical SAP Flaws Expose Authentication and Input Validation Gaps

Incident

5 min read

Two Critical SAP Flaws Expose Authentication and Input Validation Gaps

What Happened SAP s May 2026 security updates addressed 15 vulnerabilities across its enterprise software portfolio. Two critical flaws stand out for their exploitability and potential impact: CVE-202

For Compliance TeamsRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

RubyGems Used to Exfiltrate U.K. Government Data

Incident

4 min read

RubyGems Used to Exfiltrate U.K. Government Data

Incident Overview Between late 2024 and early 2025, attackers published over 150 malicious gems to the RubyGems repository. These gems were not meant to compromise developers who downloaded them. Inst

For Security EngineersRead

Guides

5 min read

CI/CD Pipeline Security Policy Template

Your CI/CD pipeline is the most privileged account in your infrastructure. It deploys to production, accesses secrets, and runs on every commit. Yet, many security policies treat it like any other sys

For Security EngineersRead

Agent Harnesses Need Real Environments, Not Mocks

Guides

5 min read

Agent Harnesses Need Real Environments, Not Mocks

Your coding agent just modified three microservices, updated a Helm chart, and pushed changes to staging. Did it work? In a traditional monolithic app, you d run the test suite and know within seconds

For DevOps LeadersRead

cPanel Backdoors Hit 40,000 Servers: Supply-Chain Blind Spot

Incident

5 min read

cPanel Backdoors Hit 40,000 Servers: Supply-Chain Blind Spot

What Happened Between late 2024 and early 2025, attackers exploited CVE-2026-41940 , a vulnerability in cPanel s web hosting management interface, compromising hosting infrastructure on a large scale.

For Security EngineersRead

HackerOne Paused Its Bug Bounty Program: What Went Wrong

Incident

4 min read

HackerOne Paused Its Bug Bounty Program: What Went Wrong

What Happened In early 2025, HackerOne paused its bug bounty program due to an overwhelming increase in vulnerability discoveries, driven by AI-assisted research. This wasn t a breach or technical fai

For Compliance TeamsRead

OIDC Tokens Hijacked to Ship Signed Malware

Incident

4 min read

OIDC Tokens Hijacked to Ship Signed Malware

On February 28, 2025, security researchers at Endor Labs discovered that attackers had published malicious versions of popular JavaScript packages—including TanStack Query and Mistral AI s SDK—using s

For DevOps LeadersRead

Incident

5 min read

RubyGems Pauses Signups After Mass Package Upload

What Happened RubyGems temporarily stopped new account creation after detecting hundreds of malicious packages uploaded to its registry. The attack involved multiple newly created accounts uploading p

For Security EngineersRead

TeamCity CVE-2026-44413: A Privilege Escalation Case Study

Incident

5 min read

TeamCity CVE-2026-44413: A Privilege Escalation Case Study

What Happened JetBrains disclosed CVE-2026-44413 , a high-severity vulnerability in TeamCity On-Premises versions 2025.11.4 and earlier. This flaw enables privilege escalation and may expose sensitive

For Security EngineersRead

TanStack Supply Chain Attack: CVE-2026-45321

Incident

4 min read

TanStack Supply Chain Attack: CVE-2026-45321

What Happened Between late 2024 and early 2025, threat actor TeamPCP executed a supply chain attack that compromised over 170 npm and PyPI packages with more than 518 million downloads. The attack, as

For Security EngineersRead

npm Supply Chain Defense: Detection and Response Protocol

General

5 min read

npm Supply Chain Defense: Detection and Response Protocol

A credential-stealing worm is spreading through hundreds of npm packages right now. The Mini Shai-Hulud worm, created by TeamPCP, targets the TanStack ecosystem specifically, but your exposure isn t l

For Security EngineersRead

170 Packages Compromised: TeamPCP npm Attack

Incident

3 min read

170 Packages Compromised: TeamPCP npm Attack

In 2024, the TeamPCP threat group executed a supply chain attack compromising 170 npm and PyPI packages, including key dependencies like the TanStack Router ecosystem and Mistral AI SDK. The attack ex

For Security EngineersRead

Incident

5 min read

LLM-Driven Exploit Chains: No Incident Yet, But Here's What Failed

The Emerging Threat This isn t a traditional incident analysis because there isn t a specific breach to dissect. Instead, a new pattern is emerging in threat intelligence: adversaries are using large

For Security EngineersRead

Showing 721-736 of 1105 articles

PreviousPage 46 of 70Next