Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1115 Security Engineers770 Compliance Teams229 DevOps Leaders65 Developers31 CISOs17 IT Directors2

Topics:All1115 Incident716 General194 Standards88 Research61 Guides36 Deadlines13 Vendor News4 Legal2

1115 articlesSort byNewest·Trending

Axios NPM Package Breach: When 9 Million Weekly Downloads Meet a Sophisticated Compromise

What Happened The NPM package for Axios was briefly compromised this week. Axios is a JavaScript HTTP client library with approximately 9 million weekly downloads, making it one of the most widely use

For DevelopersRead article

Incident

Axios Attack: 300 Million Weekly Downloads, Minutes to Detect

On March 31, 2026, attackers published malicious versions of axios—one of the most widely used HTTP client libraries in the JavaScript ecosystem. The compromised packages contained hidden dependencies

For Compliance TeamsRead

Incident

Axios Supply Chain Attack: When Account Compromise Hits 100 Million Weekly Downloads

What Happened Attackers compromised the npm account of Axios lead maintainer and published malicious versions of the library containing a remote access trojan. Axios, a widely-used HTTP client library

For Compliance TeamsRead

Incident

Axios Supply Chain Attack: How 300 Million Weekly Downloads Nearly Became a Backdoor

What Happened On March 31, 2026, attackers published malicious versions of axios —a JavaScript HTTP client library with over 300 million weekly downloads—to the npm registry. The compromised packages

For Compliance TeamsRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Google's Antigravity Tool: When Prompt Injection Becomes Remote Code Execution

Incident

4 min read

Google's Antigravity Tool: When Prompt Injection Becomes Remote Code Execution

What Happened Google patched a critical remote code execution vulnerability in Antigravity, an internal AI-based tool. The flaw arose from a prompt-injection vulnerability that allowed attackers to es

For Security EngineersRead

Should AI Agents Get Admin Access? The Debate Over Least Privilege for Autonomous Systems

Guides

4 min read

Should AI Agents Get Admin Access? The Debate Over Least Privilege for Autonomous Systems

The Question at Hand Your security team has just deployed an AI agent to automate cloud resource optimization. It s quickly scanning your entire AWS environment, analyzing usage patterns, and recommen

For Compliance TeamsRead

6,500 Unpatched ActiveMQ Instances: When AI Finds Flaws Faster Than You Can Fix Them

Incident

3 min read

6,500 Unpatched ActiveMQ Instances: When AI Finds Flaws Faster Than You Can Fix Them

Summary of the Incident A critical remote code execution vulnerability in Apache ActiveMQ was discovered using AI-assisted analysis in about 10 minutes. This vulnerability affects versions before 5.19

For Compliance TeamsRead

13 Hours: An SSRF Vulnerability Goes from Disclosure to Active Exploitation

Incident

4 min read

13 Hours: An SSRF Vulnerability Goes from Disclosure to Active Exploitation

What Happened When CVE-2026-33626 was disclosed, attackers quickly began exploiting a server-side request forgery (SSRF) vulnerability in LMDeploy, an open-source toolkit for deploying large language

For Security EngineersRead

Malicious npm Packages Stole Credentials from 8,000 Weekly Downloads

Standards

5 min read

Malicious npm Packages Stole Credentials from 8,000 Weekly Downloads

Scope - What This Guide Covers This guide provides detection, prevention, and response strategies for supply chain attacks targeting package registries. It includes steps for securing your dependency

For DevelopersRead

Bitwarden CLI Supply Chain Attack: A 95-Minute Window That Exposed Thousands of Secrets

Incident

5 min read

Bitwarden CLI Supply Chain Attack: A 95-Minute Window That Exposed Thousands of Secrets

What Happened On April 22, 2026, attackers published a compromised version of the Bitwarden command-line interface (version @bitwarden/ [email protected] ) to npm. The malicious code, embedded in a file na

For Compliance TeamsRead

Bitwarden CLI Hijacked for 90 Minutes: A CI/CD Pipeline Breach Teardown

Incident

4 min read

Bitwarden CLI Hijacked for 90 Minutes: A CI/CD Pipeline Breach Teardown

On April 22, 2025, developers who updated the Bitwarden CLI to version 2026.4.0 installed malware designed to exfiltrate their most sensitive credentials. The window was narrow—just over 90 minutes—bu

For Compliance TeamsRead

Bitwarden CLI Package Breach: How a Compromised GitHub Action Stole Developer Credentials

Incident

4 min read

Bitwarden CLI Package Breach: How a Compromised GitHub Action Stole Developer Credentials

What Happened On April 22, 2026, the @bitwarden/cli npm package was compromised with malicious code aiming to steal developer credentials. This package was available from 5:57 PM to 7:30 PM ET. During

For Security EngineersRead

Hackers Compromised a Security Tool to Steal the Secrets It Was Scanning

Incident

5 min read

Hackers Compromised a Security Tool to Steal the Secrets It Was Scanning

What Happened On April 22, 2026, attackers replaced legitimate Docker images of Checkmarx s KICS (Keeping Infrastructure as Code Secure) tool with malicious versions. KICS is an open-source scanner th

For Compliance TeamsRead

A 9.3 CVSS Vulnerability That Will Never Be Patched

Incident

5 min read

A 9.3 CVSS Vulnerability That Will Never Be Patched

What Happened CVE-2026-5752, a critical vulnerability in Cohere AI s Terrarium sandbox, allows attackers to execute arbitrary code with root privileges and escape container isolation. This flaw exploi

For Security EngineersRead

16 npm Packages Compromised in Self-Propagating Supply Chain Attack

Incident

4 min read

16 npm Packages Compromised in Self-Propagating Supply Chain Attack

What Happened On April 21, 2025, attackers published a malicious version of the pgserve package from Namastex Labs. Within days, 16 packages from the same publisher were compromised. The attack used a

For DevelopersRead

An Attacker Executed Code Through Your AI Agent and You Never Saw It

Incident

4 min read

An Attacker Executed Code Through Your AI Agent and You Never Saw It

Understanding the Vulnerability OX Security disclosed a critical vulnerability in Anthropic s Model Context Protocol (MCP) SDK that enables remote code execution across Python, TypeScript, Java, and R

For Security EngineersRead

Showing 913-928 of 1115 articles

PreviousPage 58 of 70Next