Insights &amp; Analysis

For Security EngineersRead article

Securing Your Dependency Chain Against Malicious Extensions

Your build pulls in 847 dependencies. One of them just downloaded your AWS credentials. Researchers have identified dozens of malicious GlassWorm extensions in the wild, each iteration more sophistica

AppsFlyer SDK Compromise: How a Marketing Tool Became a Cryptocurrency Theft Vector

AppsFlyer SDK Compromise: How a Marketing Tool Became a Cryptocurrency Theft Vector

What Happened Between March 9 and March 11, 2025, attackers compromised the AppsFlyer Web SDK, injecting malicious JavaScript to steal cryptocurrency. The code targeted cryptocurrency wallet addresses

88 Malicious npm Packages Still Active: What the PhantomRaven Data Tells Us

88 Malicious npm Packages Still Active: What the PhantomRaven Data Tells Us

Endor Labs researchers have identified 88 new malicious npm packages in the latest PhantomRaven campaign—81 of which are still available for download. These packages are actively stealing credentials

Stopping Self-Spreading Worms When You Can't Kill the Server

Stopping Self-Spreading Worms When You Can't Kill the Server

On March 20, 2026, Aikido Security detected CanisterWorm spreading across the npm ecosystem. Within hours, it had compromised more than 50 packages across multiple scopes. The attack used the Internet

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Trivy Scanner Breach: When 32,000 GitHub Stars Became a Liability

Trivy Scanner Breach: When 32,000 GitHub Stars Became a Liability

What Happened On March 19, 2026, attackers compromised Aqua Security s Trivy vulnerability scanner through GitHub Actions. Trivy, with over 32,000 stars on GitHub, is a critical dependency in thousand

For Compliance TeamsRead

Defending Against Decentralized Malware: What the CanisterWorm Attack Means for Your Supply Chain

Defending Against Decentralized Malware: What the CanisterWorm Attack Means for Your Supply Chain

Scope This guide covers detection and mitigation strategies for supply chain attacks using decentralized infrastructure for command-and-control operations. You ll learn to identify compromised package

AI Agents Aren't Just Fancy Chatbots: 5 Security Myths That Will Get You Breached

General

AI Agents Aren't Just Fancy Chatbots: 5 Security Myths That Will Get You Breached

Your security team might think of AI agents like web applications, but this assumption creates a new attack surface. When CNCERT warned about OpenClaw s vulnerabilities—specifically its inherently wea

Angular SSR Vulnerability Exposes Internal Networks Through Header Manipulation

3 min read

Angular SSR Vulnerability Exposes Internal Networks Through Header Manipulation

Your Angular application can inadvertently become a tool for attackers to map your internal infrastructure. CVE-2026-27739 highlights how a single oversight in HTTP header validation can turn server-s

For DevelopersRead

AI Scanners Found 11,000 Vulnerabilities in 30 Days—Here's How to Deploy One

Research

AI Scanners Found 11,000 Vulnerabilities in 30 Days—Here's How to Deploy One

Your SAST tools flag 2,000 issues per sprint. Your security team triages maybe 50. The rest pile up in Jira until someone archives them during spring cleaning. OpenAI s Codex Security identified 792 c

AI Scanner Misses SQL Injection in Payment Flow — A Case Study in Tool Limitations

AI Scanner Misses SQL Injection in Payment Flow — A Case Study in Tool Limitations

What Happened A Series B fintech company integrated an AI-powered vulnerability scanner into their CI/CD pipeline to reduce false positives from their previous SAST tool. The AI scanner was part of a

Risk-Based Security Without a Baseline Is Just Theater With Better Lighting

General

Risk-Based Security Without a Baseline Is Just Theater With Better Lighting

The Conventional Wisdom Federal agencies are embracing OMB M-26-05 , which promises a shift from checkbox compliance to risk-based validation. This move aims to replace rigid, one-size-fits-all mandat

For Compliance TeamsRead

Package Manager Security: A Four-Stage Implementation Playbook

Package Manager Security: A Four-Stage Implementation Playbook

Every npm install or pip install you run pulls code from strangers into your production systems. ENISA s Technical Advisory for Secure Use of Package Managers (March 2026) breaks dependency management

For DevelopersRead

83,000 Downloads of a Critical Auth Bypass in One Week

83,000 Downloads of a Critical Auth Bypass in One Week

What Happened On January 15, 2025, researchers disclosed CVE-2026-29000 , a critical authentication bypass vulnerability in pac4j-jwt, a widely-used Java authentication library. The flaw affects the J

Is Your AI Prompt Security Strategy Just Wishful Thinking?

Vendor News

Is Your AI Prompt Security Strategy Just Wishful Thinking?

Your team ships AI features faster than ever. Your LLM integration works beautifully. Your users love the new capabilities. But when did you last audit the security posture of your system prompts? If

For DevOps LeadersRead

AI Agent Leaked Customer PII Through Autonomous Email Actions

AI Agent Leaked Customer PII Through Autonomous Email Actions

What Happened Your organization deployed an AI agent with broad permissions to handle customer support inquiries. This agent was set up to autonomously draft and send email responses, access customer

OAuth2-proxy Authentication Bypass: A Header Smuggling Breakdown

OAuth2-proxy Authentication Bypass: A Header Smuggling Breakdown

A single HTTP header with an underscore instead of a hyphen bypassed authentication for an entire OAuth2-proxy deployment. No brute force. No stolen credentials. Just X_Forwarded_User instead of X-For