Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams912 Security Engineers1021 Compliance Teams275 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All912 Incident912 General270 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

912 articles in Incident · Clear filtersSort byNewest·Trending

Checkmarx GitHub Repository Breach: What Happened and How to Prevent It

Incident

Latest

3 min read

Checkmarx GitHub Repository Breach: What Happened and How to Prevent It

On March 23, 2026, Checkmarx—a company specializing in application security testing tools—experienced a supply chain attack on their GitHub repository. Data from this repository later surfaced on the

For Security EngineersRead article

Cryptominers Exploited Two Auth Bypass Flaws in Qinglong's Middleware

Incident

4 min read

Cryptominers Exploited Two Auth Bypass Flaws in Qinglong's Middleware

Incident Overview On February 27, 2026, researchers disclosed two authentication bypass vulnerabilities in Qinglong, an open-source task scheduler with over 19,000 GitHub stars. CVE-2026-3965 and CVE-

For Security EngineersRead

When AI Found 10,000 Vulnerabilities in Your Codebase and Your Team Had Capacity for 200

Incident

4 min read

When AI Found 10,000 Vulnerabilities in Your Codebase and Your Team Had Capacity for 200

The Challenge of AI-Driven Vulnerability Discovery On April 7, Anthropic released Claude Mythos Preview, an AI system designed to identify security vulnerabilities at scale. This tool promised to scan

For Compliance TeamsRead

20 Hours: The Langflow RCE Exploit Timeline

Incident

4 min read

20 Hours: The Langflow RCE Exploit Timeline

What Happened A critical remote code execution vulnerability in Langflow—an open-source tool for building AI pipelines—was exploited in the wild within 20 hours of public disclosure. The vulnerability

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Google Cloud Vertex AI Permissions Flaw: When Default Service Agents Become Data Exfiltration Paths

Incident

4 min read

Google Cloud Vertex AI Permissions Flaw: When Default Service Agents Become Data Exfiltration Paths

Overview of the Vulnerability Unit 42 researchers have identified a vulnerability in Google Cloud Vertex AI s permission model. This flaw allows attackers with compromised credentials to escalate priv

For Compliance TeamsRead

Axios npm Package Compromised: A Two-Hour Window That Could Have Wrecked Your Pipeline

Incident

4 min read

Axios npm Package Compromised: A Two-Hour Window That Could Have Wrecked Your Pipeline

What Happened On March 31, 2026, malicious versions of the axios npm package (1.14.1 and 0.30.4) were published to the npm registry using a compromised maintainer account (@jasonsaayman). The attacker

For Compliance TeamsRead

Axios npm Hijack: When 18 Hours of Prep Time Beat Your Dependency Checks

Incident

3 min read

Axios npm Hijack: When 18 Hours of Prep Time Beat Your Dependency Checks

What Happened Recently, attackers published two malicious versions of Axios—the npm HTTP client used by millions of JavaScript applications. Versions 1.14.1 and 0.30.4 introduced a dependency called p

For Compliance TeamsRead

Cisco Lost 300+ Repositories to a Malicious GitHub Action

Incident

4 min read

Cisco Lost 300+ Repositories to a Malicious GitHub Action

What Happened Cisco s development environment was compromised when attackers used credentials stolen from a supply chain attack on Trivy, an open-source vulnerability scanner. The threat group TeamPCP

For Compliance TeamsRead

Two OpenAI Vulnerabilities Expose the Input Validation Gap in AI Tools

Incident

5 min read

Two OpenAI Vulnerabilities Expose the Input Validation Gap in AI Tools

What Happened OpenAI recently patched two vulnerabilities in its AI products that could have enabled unauthorized data movement. The first, discovered by BeyondTrust researchers, affected Codex: a com

For Security EngineersRead

The Trivy Compromise: 75 Version Tags Poisoned in 24 Hours

Incident

4 min read

The Trivy Compromise: 75 Version Tags Poisoned in 24 Hours

What Happened Attackers compromised the Aqua Security repository hosting Trivy , a widely used vulnerability scanner, poisoning 75 of 76 version tags. This turned a tool meant to find vulnerabilities

For Security EngineersRead

513,000 Lines of AI Code Leaked Through a Source Map

Incident

4 min read

513,000 Lines of AI Code Leaked Through a Source Map

What Happened Security researcher Chaofan Shou recently discovered that Anthropic accidentally exposed the complete source code for Claude Code—their AI coding agent—through a public npm package. The

For Security EngineersRead

1,700 Malicious Packages: How UNC1069 Weaponized Four Package Ecosystems

Incident

5 min read

1,700 Malicious Packages: How UNC1069 Weaponized Four Package Ecosystems

What Happened Since January 2025, threat actor UNC1069—linked to North Korean groups BlueNoroff, Sapphire Sleet, and Stardust Chollima—deployed over 1,700 malicious packages across npm, PyPI, Go, and

For Security EngineersRead

21,764 Malware Packages in 90 Days: What npm's Supply Chain Crisis Teaches Us

Incident

3 min read

21,764 Malware Packages in 90 Days: What npm's Supply Chain Crisis Teaches Us

The Crisis Unfolds In Q1 2026, Sonatype identified 21,764 malicious packages in open source repositories, with npm accounting for 75% of these. That s 16,323 malicious packages targeting JavaScript de

For Security EngineersRead

AI Scans 100,000 Repositories in 72 Hours: The PRT-scan Attack

Incident

3 min read

AI Scans 100,000 Repositories in 72 Hours: The PRT-scan Attack

Overview of the Attack An attacker used an AI tool named PRT-scan to systematically scan GitHub repositories for misconfigurations that expose secrets. This attack automated the process of reconnaissa

For Security EngineersRead

When AI Finds Your CVE Before You Patch It

Incident

4 min read

When AI Finds Your CVE Before You Patch It

The Emerging Threat Vulnerabilities are being exploited faster than your team can deploy patches. The traditional workflow—discover, prioritize, test, deploy—now lags behind the speed of exploitation.

For CISOsRead

Anthropic's MCP Vulnerability: When "Expected Behavior" Means Remote Code Execution

Incident

5 min read

Anthropic's MCP Vulnerability: When "Expected Behavior" Means Remote Code Execution

What Happened In early 2025, security researchers at OX Security disclosed a critical vulnerability in Anthropic s Model Context Protocol (MCP) that allows remote code execution. This flaw affects ove

For Compliance TeamsRead

Showing 801-816 of 912 articles

PreviousPage 51 of 57Next