Insights & Analysis

Magento's Two-Patch Vulnerability: A Case Study in Incomplete Remediation

What Happened Adobe released a security patch for Magento in February 2022 to address CVE-2022-24086 , a critical vulnerability allowing SQL injection or PHP object injection during checkout for unaut

Automated Pentest Passed—Controls Still Failed

What Happened Your security team ran quarterly automated penetration tests on your production environment. The reports showed stable results: no critical findings and a few medium-severity issues alre

95% of CISOs Admit to Suppressing Security Findings

The Issue at Hand Between late 2024 and early 2025, Checkmarx commissioned Censuswide to survey security and development leaders in organizations using AI code generation tools. The findings revealed

The node-ipc Sabotage: When Protest Code Destroyed Production Files

On March 15, 2022, thousands of developers running npm install unknowingly pulled malicious code into their projects. The maintainer of node-ipc—a widely-used inter-process communication library—intro

3.4x More Vulnerabilities: What Happened When Enterprises Bet on AI Code

The Challenge Your development team has boosted sprint velocity by 40%. Code moves from developer workstations to production faster than ever. Pull requests that once took days now close in hours. The

AI Won't Replace Your Pentesters Yet

Security vendors and AI labs are promoting large language models as the future of automated vulnerability detection. The excitement peaked when XBOW evaluated Anthropic s Mythos Preview model, noting

Miasma Worm Leak: When GitHub Became the Distribution Channel

What Happened The Miasma worm s source code was deliberately distributed on GitHub through compromised developer accounts. Unlike accidental exposures or proof-of-concept leaks, this was a targeted at

AI Red Team Missed Probabilistic Jailbreak: What Went Wrong

84 npm Packages Poisoned Despite SLSA L3

On May 11, 2026, attackers published 84 malicious npm packages across 42 @tanstack repositories. Each package carried cryptographically valid SLSA Build Level 3 attestations. If your team relies on SL

Microsoft Removed 73 GitHub Repos After Credential Theft

What Happened Microsoft removed 73 GitHub repositories after malware compromised developer credentials and exposed a PyPI publishing token. The attack targeted the durabletask PyPI token, allowing an

7,000 Langflow Instances Exposed: CVE-2026-5027 Teardown

A path traversal vulnerability in Langflow—an open-source AI development platform with more than 149,000 GitHub stars—is being actively exploited. CVE-2026-5027 allows attackers to write arbitrary fil

Proto6: When Schema Parsing Became an RCE Vector

Cyera s security researchers disclosed six vulnerabilities in protobuf.js that turned schema validation—a process most teams assume is safe—into a remote code execution (RCE) pathway. The vulnerabilit

7,000 Langflow Instances Exposed to RCE

What Happened An unauthenticated remote code execution vulnerability (CVE-2026-5027) in Langflow, an open-source platform for building AI applications, remains unpatched despite active exploitation. T

npm Install Scripts Ran Without Approval for 15 Years

Summary of Events For over 15 years, npm allowed packages to execute arbitrary code during installation through preinstall, install, and postinstall scripts. These scripts ran automatically whenever a

Magento RCE via Extension: CVE-2026-45247 Teardown

Overview of the Vulnerability A critical remote code execution vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento 2 and Adobe Commerce allowed attackers to execute arbitrary co