Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1443 Security Engineers1023 Compliance Teams275 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All1443 Incident914 General270 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

1443 articlesSort byNewest·Trending

Checkmarx Repository Compromise: Seven Days from Publish to Exfiltration

Incident

Latest

5 min read

Checkmarx Repository Compromise: Seven Days from Publish to Exfiltration

What Happened On March 23, 2026, malicious artifacts were published through a compromised Checkmarx GitHub repository. Seven days later, on March 30, attackers exfiltrated data from systems that had c

For Compliance TeamsRead article

Incident

5 min read

Secret Leaked in MCP Server Config File

You re building an AI coding agent using GitHub s MCP Server. Your agent needs database credentials to run queries, so you hardcode them in the server configuration. Within hours, those credentials ar

For Security EngineersRead

n8n Sandbox Escape: CVE-2026-27577 Teardown

Incident

5 min read

n8n Sandbox Escape: CVE-2026-27577 Teardown

A contact form shouldn t give an attacker root access to your automation server. But in n8n versions prior to 2.10.1, that s exactly what could happen. Let s walk through how CVE-2026-27577 and CVE-20

For Security EngineersRead

MCP Risk Discovery: A 5-Phase Implementation Plan

Guides

5 min read

MCP Risk Discovery: A 5-Phase Implementation Plan

Your developers are already using AI coding assistants. Some of these assistants connect to external servers through Model Context Protocol (MCP). You likely have no visibility into which servers they

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Incident

4 min read

300,000 Ollama Servers Leaked Memory

On March 17, 2025, security researchers at Cyera disclosed CVE-2026-7482 , a critical vulnerability in Ollama that allowed attackers to extract arbitrary memory contents from running AI models. The fl

For Security EngineersRead

Incident

4 min read

Stolen Token to AWS Admin in 72 Hours

What Happened In August 2025, threat actor UNC6426 compromised the nx npm package, gaining full AWS administrator access within 72 hours. The attack began with a vulnerable pull_request_target workflo

For Security EngineersRead

MetInfo CMS Patch Ignored for 24 Days, Then Exploited

Incident

4 min read

MetInfo CMS Patch Ignored for 24 Days, Then Exploited

On May 1, 2026, attackers began exploiting CVE-2026-29014 , a PHP code injection vulnerability in MetInfo CMS with a CVSS score of 9.8. This flaw allows unauthenticated remote code execution, giving a

For Security EngineersRead

Kubernetes Fleet Management Myths Holding Back Your Scale Strategy

General

5 min read

Kubernetes Fleet Management Myths Holding Back Your Scale Strategy

Your team runs 50 Kubernetes clusters. Next quarter, you ll run 200. The year after, maybe 1,000. At some point, the management approach that got you here stops working—but most teams don t realize wh

For DevOps LeadersRead

Mozilla Ships 271 AI-Found Bugs in One Release

Incident

3 min read

Mozilla Ships 271 AI-Found Bugs in One Release

What Happened In the Firefox 150 release, Mozilla disclosed 271 vulnerabilities discovered by Anthropic s Mythos AI model. This was a controlled discovery process, not a breach, revealing flaws in cod

For Security EngineersRead

Research

5 min read

AI Extensions Are Leaking Your Prompts

When Anthropic released Claude in Chrome, your security team may have assumed the extension would follow the same isolation model as other browser extensions. This assumption was incorrect. LayerX Sec

For Security EngineersRead

Incident

3 min read

AI Pentests Show 32% High-Risk Findings

The Security Gap in AI Systems Cobalt s State of Pentesting Report highlights a significant gap between AI system security and traditional application security. When pentesters examined AI and LLM imp

For Security EngineersRead

Apache HTTP/2 Double-Free: When Default Settings Become Attack Surface

Incident

4 min read

Apache HTTP/2 Double-Free: When Default Settings Become Attack Surface

What Happened Apache HTTP Server version 2.4.66 contained a double-free vulnerability in its HTTP/2 protocol handling code (CVE-2026-23918). Discovered by Bartlomiej Dmitruk and colleagues, this flaw

For Security EngineersRead

454,600 Malicious Packages: The Axios Dependency Attack

Incident

4 min read

454,600 Malicious Packages: The Axios Dependency Attack

What Happened In 2025, attackers compromised the axios JavaScript package—one of the most widely used HTTP client libraries in the Node.js ecosystem—through a malicious transitive dependency. The atta

For Security EngineersRead

Trojanized DAEMON Tools: When Your Installer Becomes the Attack Vector

Incident

4 min read

Trojanized DAEMON Tools: When Your Installer Becomes the Attack Vector

On April 8, attackers compromised DAEMON Tools distribution infrastructure and replaced legitimate installers with trojanized versions. The attack continued through at least mid-April, affecting versi

For Compliance TeamsRead

DAEMON Tools Breach: 27 Days of Trojanized Installers

Incident

5 min read

DAEMON Tools Breach: 27 Days of Trojanized Installers

Between April 8 and May 5, 2026, Windows users who downloaded DAEMON Tools from its official website unknowingly installed malware. AVB Disc Soft s legitimate installers were compromised to deliver QU

For Compliance TeamsRead

Apache HTTP/2 Double-Free: A Patch Deployment Failure

Incident

4 min read

Apache HTTP/2 Double-Free: A Patch Deployment Failure

What Happened A double-free vulnerability in Apache HTTP Server 2.4.66 (CVE-2026-23918, CVSS 8.8) allowed remote attackers to crash servers and potentially execute arbitrary code. The flaw existed in

For Security EngineersRead

Showing 1089-1104 of 1443 articles

PreviousPage 69 of 91Next