Expert perspectives on application security, compliance, and emerging threats
IncidentIncident Overview On March 8, 2026, attackers exploited stolen GitHub personal access tokens to force-push malicious code into legitimate Python repositories. This campaign, known as GlassWorm/ForceMe
IncidentBetween August 2025 and now, PhantomRaven published 126 malicious packages to the npm registry. These packages used slopsquatting—intentional misspellings of popular libraries—to trick JavaScript deve
IncidentWhat Happened On March 5, 2025, CISA added CVE-2025-68613 to its Known Exploited Vulnerabilities catalog. This vulnerability affects n8n, a workflow automation platform used to connect APIs and automa
IncidentYour AI infrastructure just became an exfiltration pipeline. Recent disclosures reveal how Amazon Bedrock, LangSmith, and SGLang each failed fundamental security controls—and how those failures map di
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Between late 2024 and early 2025, attackers compromised 433 code repositories and packages across GitHub, npm, and OpenVSX marketplaces. The malware, known as GlassWorm, infiltrated thes
IncidentWhat Happened On April 29, TeamPCP executed a supply chain attack that compromised over 1,800 developer repositories across PyPI, NPM, and PHP ecosystems. The attackers published malicious versions of
IncidentOn a recent weekend, attackers rewrote nearly every version tag in the aquasecurity/trivy-action repository. Within hours, CI/CD pipelines across hundreds of organizations were executing malicious cod
ResearchThe Problem: Hidden Threats in VS Code Extensions Recently, Socket researchers found 72 malicious Open VSX extensions impersonating popular tools like ESLint and Prettier. The GlassWorm campaign explo
IncidentWhat Happened On January 8, 2025, researchers disclosed CVE-2026-33017 , a critical unauthenticated remote code execution vulnerability in Langflow, an open-source platform for building AI application
IncidentWhat Happened On January 17, 2025, attackers compromised Aqua Security s Trivy vulnerability scanner through its GitHub Actions repository. The breach affected trivy-action, a GitHub Action wrapper us
IncidentWhat Happened On March 19, 2026, Sonatype Security Research reported two malicious npm packages—sbx-mask and touch-adv—to npm s maintainers. These packages were published through a compromised trusted
IncidentWhat Happened In 2024, TeamPCP compromised the Trivy vulnerability scanner, an open-source tool used by many organizations to detect security issues in containers and dependencies. The attackers publi
GeneralScope This guide explains how to combine traditional rule-based static analysis with AI reasoning to detect complex vulnerabilities in application code. You ll learn when to use each detection method,
IncidentOn January 14, 2025, Checkmarx disclosed that threat actor TeamPCP compromised their GitHub Actions workflows by stealing CI credentials. This incident, similar to a previous attack on Aqua Security s
IncidentOn PyPI, malicious versions of LiteLLM were available for download for about three hours. The attack vector? A compromised Trivy GitHub Action that stole the maintainer s PyPI publishing credentials.
IncidentWhat Happened On March 24, 2026, threat actor TeamPCP released two compromised versions of the Python package litellm—versions 1.82.7 and 1.82.8. These contained a multi-stage attack toolkit, includin
