Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams912 Security Engineers1021 Compliance Teams275 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All912 Incident912 General270 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

912 articles in Incident · Clear filtersSort byNewest·Trending

Two npm Packages Turned Data Thieves Through Compromised Maintainer Credentials

Incident

Latest

4 min read

Two npm Packages Turned Data Thieves Through Compromised Maintainer Credentials

What Happened On March 19, 2026, Sonatype Security Research reported two malicious npm packages—sbx-mask and touch-adv—to npm s maintainers. These packages were published through a compromised trusted

For Security EngineersRead article

Trivy Breach: When Your Vulnerability Scanner Ships Malware

Incident

4 min read

Trivy Breach: When Your Vulnerability Scanner Ships Malware

What Happened In 2024, TeamPCP compromised the Trivy vulnerability scanner, an open-source tool used by many organizations to detect security issues in containers and dependencies. The attackers publi

For DevOps LeadersRead

Checkmarx GitHub Actions Breach: A CI/CD Credential Theft Teardown

Incident

4 min read

Checkmarx GitHub Actions Breach: A CI/CD Credential Theft Teardown

On January 14, 2025, Checkmarx disclosed that threat actor TeamPCP compromised their GitHub Actions workflows by stealing CI credentials. This incident, similar to a previous attack on Aqua Security s

For Security EngineersRead

A Poisoned Security Scanner Backdoored a Python Package in Three Hours

Incident

4 min read

A Poisoned Security Scanner Backdoored a Python Package in Three Hours

On PyPI, malicious versions of LiteLLM were available for download for about three hours. The attack vector? A compromised Trivy GitHub Action that stole the maintainer s PyPI publishing credentials.

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Credential Harvester Hiding in Your Security Scanner: The LiteLLM Backdoor

Incident

4 min read

Credential Harvester Hiding in Your Security Scanner: The LiteLLM Backdoor

What Happened On March 24, 2026, threat actor TeamPCP released two compromised versions of the Python package litellm—versions 1.82.7 and 1.82.8. These contained a multi-stage attack toolkit, includin

For Security EngineersRead

Trivy Infostealer: How a Security Scanner Became an Exfiltration Tool

Incident

4 min read

Trivy Infostealer: How a Security Scanner Became an Exfiltration Tool

Incident Overview A threat actor compromised CI/CD pipelines by deploying malicious code through an open source security tool. This attack used an infostealer to exfiltrate cloud credentials, SSH keys

For Security EngineersRead

3,000 Repositories Poisoned in Two Minutes: The Trivy Supply Chain Attack

Incident

5 min read

3,000 Repositories Poisoned in Two Minutes: The Trivy Supply Chain Attack

What Happened On March 22, 2026, threat actor TeamPCP compromised the Trivy vulnerability scanner s Docker Hub distribution channel and attacked Aqua Security s GitHub infrastructure. Malicious versio

For Security EngineersRead

Checkmarx Supply Chain Compromise: Four Hours That Exposed CI/CD Pipeline Risks

Incident

4 min read

Checkmarx Supply Chain Compromise: Four Hours That Exposed CI/CD Pipeline Risks

Incident Overview On March 23, 2026, an attacker published malicious versions of two Checkmarx plugins to the OpenVSX registry: ast-results-2.53.0.vsix and cx-dev-assist-1.7.0.vsix. Between 12:58 and

For DevOps LeadersRead

Microsoft Logs the First Major AI Prompt Abuse Campaign

Incident

4 min read

Microsoft Logs the First Major AI Prompt Abuse Campaign

In late 2024, Microsoft s Security Response Center documented a coordinated attempt to manipulate enterprise AI assistants through carefully crafted prompts. Attackers used role-playing scenarios and

For Security EngineersRead

Two Minutes to Full Repository Access: The Aqua Security Breach

Incident

4 min read

Two Minutes to Full Repository Access: The Aqua Security Breach

On March 22, 2025, Aqua Security detected unauthorized Docker image tags for Trivy—their widely-used container vulnerability scanner—appearing without corresponding GitHub releases. The investigation

For DevOps LeadersRead

97.9% of Azure APIM Portals Still Exploitable After "By Design" Response

Incident

5 min read

97.9% of Azure APIM Portals Still Exploitable After "By Design" Response

What Happened Security researcher Mihalis Haatainen discovered a critical vulnerability in Azure API Management Developer Portals: disabling self-signup in the administrative interface doesn t actuall

For Security EngineersRead

28.65 Million Secrets Leaked to Public GitHub in 2025

Incident

5 min read

28.65 Million Secrets Leaked to Public GitHub in 2025

What Happened GitGuardian s State of Secrets Sprawl 2026 reported 28.65 million new hardcoded secrets committed to public GitHub repositories during 2025. These included not only API keys from legacy

For Security EngineersRead

CVE-2026-33017: How Langflow's RCE Flaw Was Exploited in 20 Hours

Incident

5 min read

CVE-2026-33017: How Langflow's RCE Flaw Was Exploited in 20 Hours

What Happened The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-33017 to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a remote code exec

For Security EngineersRead

Two Hours, 36% of Cloud Environments: The LiteLLM Supply Chain Attack

Incident

4 min read

Two Hours, 36% of Cloud Environments: The LiteLLM Supply Chain Attack

What Happened Malicious versions of LiteLLM, a Python middleware for LLM API calls, were available on PyPI for about two hours. These versions contained malware designed to steal cloud provider keys a

For Security EngineersRead

CVE-2026-33017: Twenty Hours from Disclosure to Active Exploitation

Incident

3 min read

CVE-2026-33017: Twenty Hours from Disclosure to Active Exploitation

Immediate Threat Overview On January 16, 2025, researchers disclosed CVE-2026-33017 , a critical vulnerability in Langflow versions 1.8.2 and earlier, allowing unauthenticated remote code execution. W

For Security EngineersRead

Langflow Code Injection: From Disclosure to Exploitation in Hours

Incident

4 min read

Langflow Code Injection: From Disclosure to Exploitation in Hours

What Happened Threat actors exploited a code injection vulnerability in Langflow, an AI platform for building LLM-powered applications, within hours of its public disclosure. This vulnerability allowe

For Security EngineersRead

Showing 753-768 of 912 articles

PreviousPage 48 of 57Next