Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1442 Security Engineers1022 Compliance Teams275 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All1442 Incident913 General270 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

1442 articlesSort byNewest·Trending

Jackson Deserialization Myths That Put Your Java Apps at Risk

General

Latest

5 min read

Jackson Deserialization Myths That Put Your Java Apps at Risk

You ve added Jackson to your project, configured your ObjectMapper, and moved on. The library works, your tests pass, and JSON flows through your API without issue. But security engineers keep finding

For Security EngineersRead article

FTC Tells Companies: Fix Log4j or Face Legal Action

Incident

4 min read

FTC Tells Companies: Fix Log4j or Face Legal Action

What Happened The Federal Trade Commission (FTC) issued a public warning to companies: if you fail to protect consumer data from exposure due to Log4j vulnerabilities, they will pursue legal action. T

For Compliance TeamsRead

One Maintainer Broke 95,000 Builds in a Week

Incident

4 min read

One Maintainer Broke 95,000 Builds in a Week

On January 9, 2022, developers worldwide faced a sudden disruption: their builds were broken. This wasn t due to a zero-day exploit or a sophisticated supply chain attack, but rather a maintainer inte

For Compliance TeamsRead

CVE-2021-44832: A Disclosure Failure Teardown

Incident

4 min read

CVE-2021-44832: A Disclosure Failure Teardown

On December 28, 2021, the Apache Log4j team released version 2.17.1 to patch CVE-2021-44832, a remote code execution vulnerability with a CVSS score of 6.6. The technical details are less critical tha

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Log4Shell: The Dependency You Didn't Know You Had

Incident

3 min read

Log4Shell: The Dependency You Didn't Know You Had

What Happened On December 10, 2021, the Apache Log4j team disclosed CVE-2021-44832 , a remote code execution vulnerability in a widely used Java logging library. Attackers could exploit this by sendin

For Security EngineersRead

Incident

4 min read

Log4j 2.16 DoS: When a Patch Becomes an Incident

What Happened On December 18, 2021, Apache disclosed CVE-2021-45105 , a high-severity Denial of Service vulnerability in Log4j version 2.16 — the version released just days earlier to fix CVE-2021-450

For Security EngineersRead

Incident

4 min read

Log4j 2.15 Fell in 72 Hours

What Happened On December 14, 2021, Apache released Log4j version 2.15.0 to address CVE-2021-44228 , the Log4Shell vulnerability. Security teams worldwide rushed to deploy the patch. However, three da

For Security EngineersRead

AI Code Models Trained on Swept Data Cut Vulnerabilities by 41%

General

3 min read

AI Code Models Trained on Swept Data Cut Vulnerabilities by 41%

The focus on AI-assisted coding often centers on model architecture and performance metrics. However, new data from Sonar s SonarSweep experiments highlights a critical factor: the quality of training

For Security EngineersRead

Log4Shell: How a Logging Library Became CVE-2021-44228

Incident

4 min read

Log4Shell: How a Logging Library Became CVE-2021-44228

What Happened In December 2021, a critical vulnerability in Apache Log4j—a widely used Java logging library—allowed attackers to execute arbitrary code on vulnerable systems. This exploit, known as CV

For Compliance TeamsRead

Loop-Driven AI Development: A Verification Field Guide

General

5 min read

Loop-Driven AI Development: A Verification Field Guide

In AI-driven development, verifying that your agents build correctly is as important as what they build. The shift from prompt-driven to loop-driven development fundamentally changes your verification

For Security EngineersRead

AI Agents Won't Fix Your Spring Upgrades

General

5 min read

AI Agents Won't Fix Your Spring Upgrades

You ve probably heard the pitch: point an AI coding agent at your legacy Spring Boot 2.7 codebase, and watch it handle the upgrade to Spring Boot 3 or 4. No more manual refactoring. No more dependency

For DevOps LeadersRead

AI Agent Runs Malicious Code from Error Logs

Incident

5 min read

AI Agent Runs Malicious Code from Error Logs

What Happened Tenet Security discovered a new attack pattern called Agentjacking that weaponizes AI coding agents against their own development teams. The attack works by injecting malicious code into

For Security EngineersRead

When the AI Agent You Built Stops Working

Incident

4 min read

When the AI Agent You Built Stops Working

You developed an AI security agent in just three days. It scanned your repositories, flagged secrets, and impressed your VP. Two months later, it s generating 400 false positives per day, and your tea

For Security EngineersRead

phpBB's Ten-Year Auth Bypass: A Teardown

Incident

4 min read

phpBB's Ten-Year Auth Bypass: A Teardown

An authentication bypass vulnerability lingered in phpBB s codebase for a decade, allowing admin access through a specially crafted request. Aikido discovered the flaw on June 2nd, and phpBB released

For Security EngineersRead

Log4Shell: When a Logging Library Became an RCE Vector

Incident

5 min read

Log4Shell: When a Logging Library Became an RCE Vector

What Happened On December 9, 2021, security researchers disclosed CVE-2021-44228 , a critical remote code execution vulnerability in Log4j2, a widely used Java logging framework maintained by the Apac

For Security EngineersRead

3,000 Stolen GitHub Tokens Found on Dark Forums

Incident

4 min read

3,000 Stolen GitHub Tokens Found on Dark Forums

What Happened Flare researchers discovered active listings for compromised developer credentials and access tokens on underground forums—weeks before these same credentials appeared in public supply-c

For Security EngineersRead

Showing 769-784 of 1442 articles

PreviousPage 49 of 91Next