Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams291 Security Engineers142 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All291 Incident142 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

291 articlesSort byNewest·Trending

Prepare Your Development Pipeline for EU Cyber Resilience Act Compliance

Deadlines

Latest

6 min read

Prepare Your Development Pipeline for EU Cyber Resilience Act Compliance

The EU Cyber Resilience Act (CRA) will be fully enforced by December 2027. This gives your team a 36-month window to overhaul how you handle security requirements for any product sold in the EU market

For Compliance TeamsRead article

21,764 Malware Packages in 90 Days: What npm's Supply Chain Crisis Teaches Us

Incident

3 min read

21,764 Malware Packages in 90 Days: What npm's Supply Chain Crisis Teaches Us

The Crisis Unfolds In Q1 2026, Sonatype identified 21,764 malicious packages in open source repositories, with npm accounting for 75% of these. That s 16,323 malicious packages targeting JavaScript de

For Security EngineersRead

AI Scans 100,000 Repositories in 72 Hours: The PRT-scan Attack

Incident

3 min read

AI Scans 100,000 Repositories in 72 Hours: The PRT-scan Attack

Overview of the Attack An attacker used an AI tool named PRT-scan to systematically scan GitHub repositories for misconfigurations that expose secrets. This attack automated the process of reconnaissa

For Security EngineersRead

When AI Finds Your CVE Before You Patch It

Incident

4 min read

When AI Finds Your CVE Before You Patch It

The Emerging Threat Vulnerabilities are being exploited faster than your team can deploy patches. The traditional workflow—discover, prioritize, test, deploy—now lags behind the speed of exploitation.

For CISOsRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Risk-Based Vulnerability Triage After NIST's Pivot to Selective Enrichment

Standards

5 min read

Risk-Based Vulnerability Triage After NIST's Pivot to Selective Enrichment

NIST enriched nearly 42,000 CVEs in 2025, a 45% increase over previous years. Yet they just announced they re scaling back. Why? CVE submissions jumped 263% between 2020 and 2025, and the old model of

For Compliance TeamsRead

SBOMs Won't Save You From Supply Chain Risk

Guides

4 min read

SBOMs Won't Save You From Supply Chain Risk

The Conventional Wisdom Your compliance team might believe that supply chain security is addressed by generating Software Bills of Materials (SBOMs). Create an SBOM for every release, submit it to the

For Compliance TeamsRead

Anthropic's MCP Vulnerability: When "Expected Behavior" Means Remote Code Execution

Incident

5 min read

Anthropic's MCP Vulnerability: When "Expected Behavior" Means Remote Code Execution

What Happened In early 2025, security researchers at OX Security disclosed a critical vulnerability in Anthropic s Model Context Protocol (MCP) that allows remote code execution. This flaw affects ove

For Compliance TeamsRead

"Wait, Our Template Engine Can Execute Code?"

Standards

4 min read

"Wait, Our Template Engine Can Execute Code?"

I ve been fielding urgent questions about CVE-2026-40478 in Thymeleaf. Many teams using Java Spring apps with Thymeleaf are now facing a 9.1 CVSS vulnerability that allows unauthenticated attackers to

For Compliance TeamsRead

How a Compromised AI Tool Gave Attackers Full Access to Vercel's Infrastructure

Incident

5 min read

How a Compromised AI Tool Gave Attackers Full Access to Vercel's Infrastructure

What Happened On December 20, 2024, Vercel discovered unauthorized access to their internal systems through a compromised OAuth token belonging to Context.ai, a third-party AI coding assistant integra

For Compliance TeamsRead

Bitwarden CLI Trojan: How a GitHub Action Became a Supply Chain Weapon

Incident

4 min read

Bitwarden CLI Trojan: How a GitHub Action Became a Supply Chain Weapon

What Happened On April 22, 2025, attackers published a malicious version of the Bitwarden CLI password manager (version 2026.4.0) to the npm registry. The compromised package was available for about 1

For Security EngineersRead

A Critical RMM Flaw Exposes the Hidden Attack Surface in Your Supply Chain

Incident

4 min read

A Critical RMM Flaw Exposes the Hidden Attack Surface in Your Supply Chain

What Happened A critical remote code execution vulnerability (CVE-2026-1731) in Bomgar s remote monitoring and management (RMM) platform has exposed organizations to significant risk. This flaw allowe

For Compliance TeamsRead

Should You Pin, Verify, or Isolate Your Developer Tools?

Standards

5 min read

Should You Pin, Verify, or Isolate Your Developer Tools?

When Socket alerted on malicious Docker images in the official checkmarx/kics repository—including a new tag v2.1.21—and compromised VS Code extensions (checkmarx/ [email protected] and 1.19.0), se

For Compliance TeamsRead

Self-Propagating npm Malware Steals Credentials, Publishes More Malware

Incident

4 min read

Self-Propagating npm Malware Steals Credentials, Publishes More Malware

What Happened The CanisterSprawl malware campaign compromised npm packages to steal sensitive data from developer machines, such as tokens and API keys. It then used these credentials to publish more

For DevelopersRead

AI Found 10,000 Vulnerabilities in Your Code. Now What?

Standards

4 min read

AI Found 10,000 Vulnerabilities in Your Code. Now What?

Scope - What This Guide Covers This guide addresses the operational gap between discovering vulnerabilities and fixing them in environments where AI-assisted scanning is common. You ll find frameworks

For CISOsRead

Standards

Malicious npm Package Impersonates Bitwarden CLI: Three Attack Vectors in One

On April 23, 2026, Mend.io discovered a compromised package on npm masquerading as @bitwarden/cli version 2026.4.0. This package combined three attack mechanisms: a self-propagating npm worm, a GitHub

For Security EngineersRead

Incident

Stolen Publishing Tokens: How CanisterSprawl Turned npm Maintainers Into Attack Vectors

What Happened In late 2024, security researchers at StepSecurity and Socket disclosed CanisterSprawl, an npm malware campaign that exploits developer environments to steal credentials and publish mali

For Security EngineersRead

Showing 65-80 of 291 articles

PreviousPage 5 of 19Next