Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened On March 31, 2026, malicious versions of the axios npm package (1.14.1 and 0.30.4) were published to the npm registry using a compromised maintainer account (@jasonsaayman). The attacker
IncidentWhat Happened Recently, attackers published two malicious versions of Axios—the npm HTTP client used by millions of JavaScript applications. Versions 1.14.1 and 0.30.4 introduced a dependency called p
IncidentWhat Happened Cisco s development environment was compromised when attackers used credentials stolen from a supply chain attack on Trivy, an open-source vulnerability scanner. The threat group TeamPCP
IncidentWhat Happened OpenAI recently patched two vulnerabilities in its AI products that could have enabled unauthorized data movement. The first, discovered by BeyondTrust researchers, affected Codex: a com
Get weekly security insights and compliance updates delivered to your inbox.
ResearchYour security team closed 87% of critical vulnerabilities last quarter. That sounds impressive until you realize the definition of critical just changed — and the volume tripled. OX Security s analysi
IncidentWhat Happened Attackers compromised the Aqua Security repository hosting Trivy , a widely used vulnerability scanner, poisoning 75 of 76 version tags. This turned a tool meant to find vulnerabilities
StandardsStarting April 15, NIST will stop enriching and scoring lower-priority vulnerabilities. Submission volumes grew 263% while NIST enriched 42,000 CVEs in 2025 — they can t keep up. If your vulnerability
StandardsYour PHP applications rely on Composer . If you re running versions between 2.0 and 2.2.27 or between 2.3 and 2.9.6, you are exposed to command injection vulnerabilities in your dependency management
StandardsThe compromise of the Axios npm package through social engineering highlights a critical vulnerability in the software supply chain: the security of your dependencies is only as strong as the people w
IncidentWhat Happened Security researcher Chaofan Shou recently discovered that Anthropic accidentally exposed the complete source code for Claude Code—their AI coding agent—through a public npm package. The
IncidentWhat Happened Since January 2025, threat actor UNC1069—linked to North Korean groups BlueNoroff, Sapphire Sleet, and Stardust Chollima—deployed over 1,700 malicious packages across npm, PyPI, Go, and
StandardsOn April 22, 2026, malicious versions of xinference appeared on PyPI, targeting AI inference servers with credential theft payloads that leave no persistent traces. This attack marks a tactical shift:
StandardsScope - What This Guide Covers With NIST reducing its role in CVE data enrichment, your vulnerability management program must adapt. This guide details the changes, their impact, and the necessary adj
GuidesContext: Questions from teams deploying AI agents Security channels have been inundated with questions after OX Security disclosed vulnerabilities in the Model Context Protocol (MCP). Over 30 remote c
DeadlinesThe EU Cyber Resilience Act (CRA) will be fully enforced by December 2027. This gives your team a 36-month window to overhaul how you handle security requirements for any product sold in the EU market
IncidentThe Crisis Unfolds In Q1 2026, Sonatype identified 21,764 malicious packages in open source repositories, with npm accounting for 75% of these. That s 16,323 malicious packages targeting JavaScript de
