Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1442 Security Engineers1022 Compliance Teams275 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All1442 Incident913 General270 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

1442 articlesSort byNewest·Trending

Red Hat npm Namespace Hijacked via Install Scripts

Incident

Latest

4 min read

Red Hat npm Namespace Hijacked via Install Scripts

On a routine Thursday, packages under the @redhat-cloud-services namespace on npm began executing malware during installation. The compromised packages—including @redhat-cloud-services/types—ran malic

For Security EngineersRead article

CISA Orders Patching of CVE-2024-21182: What Went Wrong

Incident

4 min read

CISA Orders Patching of CVE-2024-21182: What Went Wrong

Incident Overview The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-21182 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch Oracle WebLogic S

For Compliance TeamsRead

Malicious Dependencies: 5 Myths Blocking Your Defense

General

5 min read

Malicious Dependencies: 5 Myths Blocking Your Defense

Your team likely runs static analysis on code after it s committed, scans containers before deployment, and uses software composition analysis to track known CVEs in your dependencies. However, if you

For Security EngineersRead

Red Hat npm Breach: Stolen Credentials, Worm Propagation

Incident

4 min read

Red Hat npm Breach: Stolen Credentials, Worm Propagation

What Happened Between April and May 2026, attackers compromised Red Hat s GitHub credentials and injected malicious code into npm packages maintained by the company. The malware, dubbed Miasma: The Sp

For DevOps LeadersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Spring Security CVE-2022-31692: When RegexRequestMatchers Fail

Incident

3 min read

Spring Security CVE-2022-31692: When RegexRequestMatchers Fail

Understanding the Vulnerability CVE-2022-31692 revealed a critical flaw in Spring Security versions 5.6.x through 5.7.4, scoring 9.8 on the National Vulnerability Database. Applications using RegexReq

For Security EngineersRead

CircleCI Breach: When Static Secrets Become Skeleton Keys

Incident

4 min read

CircleCI Breach: When Static Secrets Become Skeleton Keys

What Happened On January 4, CircleCI discovered unauthorized access to their systems and immediately advised all customers to rotate their secrets. The company invalidated Personal and Project API tok

For Security EngineersRead

Flowise RCE: When Input Validation Becomes Security Theater

Incident

4 min read

Flowise RCE: When Input Validation Becomes Security Theater

What Happened Obsidian Security disclosed CVE-2026-40933, a critical remote code execution vulnerability in Flowise s Model Context Protocol (MCP) stdio server implementation. The vulnerability has a

For Security EngineersRead

29,000 Weekly Downloads of a Token Stealer

Incident

4 min read

29,000 Weekly Downloads of a Token Stealer

What Happened A malicious npm package named codexui-android infiltrated the supply chain of OpenAI Codex users, exfiltrating authentication tokens to an attacker-controlled server at sentry.anyclaw[.]

For Security EngineersRead

44 Hours to Compromise: The Equifax Patch Gap

Incident

5 min read

44 Hours to Compromise: The Equifax Patch Gap

What Happened On September 7, 2017, Equifax disclosed a breach that exposed personal information of 147 million people. The attack exploited CVE-2017-5638 , a remote code execution vulnerability in Ap

For Security EngineersRead

Incident

4 min read

SnakeYaml's Constructor Flaw: A Deserialization Incident Map

What Happened CVE-2022-1471 exposed a critical flaw in SnakeYaml s Constructor class, allowing arbitrary code execution through unsafe deserialization. This vulnerability affects the org.yaml:snakeyam

For Security EngineersRead

Crypto-js Weak Hash: When 1 Iteration Meets Production

Incident

4 min read

Crypto-js Weak Hash: When 1 Iteration Meets Production

What Happened Security researcher Zemnmez discovered a use-of-weak-hash vulnerability in crypto-js and crypto-es, two widely-used JavaScript cryptography libraries. The vulnerability (CVE-2023-46233 f

For Security EngineersRead

Dependency Review Policy Template for OSS Packages

Guides

6 min read

Dependency Review Policy Template for OSS Packages

Purpose of the Template Your dependency management policy must be robust to prevent the next supply chain incident from affecting your production environment. This template establishes governance cont

For Compliance TeamsRead

Libcurl CVE-2023-38545: What Broke and What You Fix Next

Incident

4 min read

Libcurl CVE-2023-38545: What Broke and What You Fix Next

What Happened On October 11, 2023, the curl project disclosed CVE-2023-38545 , a heap-based buffer overflow in libcurl versions 7.69.0 through 8.3.0. The vulnerability affects the SOCKS5 proxy handsha

For Security EngineersRead

Your Team Is Misreading the AI Executive Order

Deadlines

5 min read

Your Team Is Misreading the AI Executive Order

The Executive Order on AI Safety, issued on October 30 by President Biden, isn t legally binding. Compliance teams often use this fact to justify inaction. However, this EO signals future regulatory d

For Compliance TeamsRead

40% Still Skip SCA and SAST: A Breakdown

Incident

4 min read

40% Still Skip SCA and SAST: A Breakdown

The Problem Snyk s 2023 State of Open Source Security report highlights a critical issue: 40% of organizations do not use Software Composition Analysis (SCA) or Static Application Security Testing (SA

For Security EngineersRead

CVE-2023-4863: When a Browser Bug Becomes Everyone's Problem

Incident

4 min read

CVE-2023-4863: When a Browser Bug Becomes Everyone's Problem

What Happened On September 11, 2023, CVE-2023-4863 was disclosed with a CVSS score of 9.6. The vulnerability affects libwebp, an image codec library, across versions 0.5.0 through 1.3.1. An attacker c

For Security EngineersRead

Showing 881-896 of 1442 articles

PreviousPage 56 of 91Next