Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams913 Security Engineers1022 Compliance Teams275 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All913 Incident913 General270 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

913 articles in Incident · Clear filtersSort byNewest·Trending

56% of Vulnerable Magento Stores Hit Within 10 Days

Incident

Latest

5 min read

56% of Vulnerable Magento Stores Hit Within 10 Days

What Happened Mass exploitation of the PolyShell vulnerability in Magento Open Source and Adobe Commerce began on March 19th. Within days, attackers compromised 56.7% of all vulnerable stores. The att

For Compliance TeamsRead article

4,000 Downloads of Malicious Code: The Cline npm Package Compromise

Incident

4 min read

4,000 Downloads of Malicious Code: The Cline npm Package Compromise

What Happened The npm package Cline version 2.3.0 was compromised with malicious code that installed OpenClaw, a backdoor tool, on developer machines. This version was downloaded over 4,000 times befo

For Security EngineersRead

Authentication Bypass in pac4j-jwt Exposes Java Applications

Incident

5 min read

Authentication Bypass in pac4j-jwt Exposes Java Applications

What Happened CVE-2026-29000, a critical authentication bypass vulnerability in the pac4j-jwt library, allows attackers to bypass authentication controls in Java applications. The flaw was identified

For Security EngineersRead

AI Agent Turned Exfiltration Tool: The PleaseFix Vulnerability

Incident

5 min read

AI Agent Turned Exfiltration Tool: The PleaseFix Vulnerability

Your AI browser agent just accessed your local file system, read your credentials, and sent them to an attacker. You didn t click anything. You didn t approve any action. The agent did it autonomously

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

1,000 SaaS Environments Compromised Through a Security Scanner

Incident

4 min read

1,000 SaaS Environments Compromised Through a Security Scanner

What Happened Between late 2024 and early 2025, attackers compromised the Trivy vulnerability scanner s supply chain by stealing npm publish tokens. They backdoored more than 29 packages that Trivy de

For Compliance TeamsRead

15,000 Magento Stores Hit by Defacement: PolyShell Vulnerability Teardown

Incident

4 min read

15,000 Magento Stores Hit by Defacement: PolyShell Vulnerability Teardown

What Happened Security researchers at Sansec discovered a critical vulnerability in Magento s REST API, designated PolyShell, that allows attackers to upload malicious files to e-commerce sites withou

For Compliance TeamsRead

AppsFlyer SDK Compromise: How a Marketing Tool Became a Cryptocurrency Theft Vector

Incident

5 min read

AppsFlyer SDK Compromise: How a Marketing Tool Became a Cryptocurrency Theft Vector

What Happened Between March 9 and March 11, 2025, attackers compromised the AppsFlyer Web SDK, injecting malicious JavaScript to steal cryptocurrency. The code targeted cryptocurrency wallet addresses

For Security EngineersRead

Trivy Scanner Breach: When 32,000 GitHub Stars Became a Liability

Incident

4 min read

Trivy Scanner Breach: When 32,000 GitHub Stars Became a Liability

What Happened On March 19, 2026, attackers compromised Aqua Security s Trivy vulnerability scanner through GitHub Actions. Trivy, with over 32,000 stars on GitHub, is a critical dependency in thousand

For Compliance TeamsRead

Angular SSR Vulnerability Exposes Internal Networks Through Header Manipulation

Incident

3 min read

Angular SSR Vulnerability Exposes Internal Networks Through Header Manipulation

Your Angular application can inadvertently become a tool for attackers to map your internal infrastructure. CVE-2026-27739 highlights how a single oversight in HTTP header validation can turn server-s

For DevelopersRead

AI Scanner Misses SQL Injection in Payment Flow — A Case Study in Tool Limitations

Incident

4 min read

AI Scanner Misses SQL Injection in Payment Flow — A Case Study in Tool Limitations

What Happened A Series B fintech company integrated an AI-powered vulnerability scanner into their CI/CD pipeline to reduce false positives from their previous SAST tool. The AI scanner was part of a

For Security EngineersRead

83,000 Downloads of a Critical Auth Bypass in One Week

Incident

4 min read

83,000 Downloads of a Critical Auth Bypass in One Week

What Happened On January 15, 2025, researchers disclosed CVE-2026-29000 , a critical authentication bypass vulnerability in pac4j-jwt, a widely-used Java authentication library. The flaw affects the J

For Security EngineersRead

AI Agent Leaked Customer PII Through Autonomous Email Actions

Incident

5 min read

AI Agent Leaked Customer PII Through Autonomous Email Actions

What Happened Your organization deployed an AI agent with broad permissions to handle customer support inquiries. This agent was set up to autonomously draft and send email responses, access customer

For Security EngineersRead

OAuth2-proxy Authentication Bypass: A Header Smuggling Breakdown

Incident

4 min read

OAuth2-proxy Authentication Bypass: A Header Smuggling Breakdown

A single HTTP header with an underscore instead of a hyphen bypassed authentication for an entire OAuth2-proxy deployment. No brute force. No stolen credentials. Just X_Forwarded_User instead of X-For

For Security EngineersRead

26 Malicious npm Packages: A Supply Chain Attack Breakdown

Incident

4 min read

26 Malicious npm Packages: A Supply Chain Attack Breakdown

What Happened A recent campaign by the North Korean threat actor group Famous Chollima involved the publication of 26 malicious packages to the npm registry. These packages deployed a cross-platform r

For Compliance TeamsRead

1.45 Billion Attacks: How SMBs Became the Primary Target for API Exploits

Incident

4 min read

1.45 Billion Attacks: How SMBs Became the Primary Target for API Exploits

The Surge in API Attacks In the first half of 2025, small and medium-sized businesses (SMBs) faced over 1.45 billion attacks, with API-targeted exploits increasing 74 times compared to previous period

For Compliance TeamsRead

When AI Pentesting Tools Miss What Matters: A Burp AI Case Study

Incident

3 min read

When AI Pentesting Tools Miss What Matters: A Burp AI Case Study

Understanding the Gap in AI Pentesting CyberMaddy, a security researcher, evaluated Burp AI s vulnerability detection capabilities using test web applications. The tool identified common vulnerabiliti

For Security EngineersRead

Showing 865-880 of 913 articles

PreviousPage 55 of 58Next