Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams707 Security Engineers759 Compliance Teams223 DevOps Leaders63 Developers31 CISOs17 IT Directors2

Topics:All707 Incident707 General188 Standards88 Research61 Guides34 Deadlines11 Vendor News4 Legal2

707 articles in Incident · Clear filtersSort byNewest·Trending

Mythos Finds 1,000 Bugs in 10 Hours: Where EPSS Fits In

Incident

Latest

4 min read

Mythos Finds 1,000 Bugs in 10 Hours: Where EPSS Fits In

What Happened In October 2024, Anthropic deployed an AI agent called Mythos to scan its codebase. The system identified roughly 1,000 potential vulnerabilities in just 10 hours. For context, that s ab

For Security EngineersRead article

Joomla Zero-Days: What Two File Upload Flaws Reveal About CMS Defense

Incident

4 min read

Joomla Zero-Days: What Two File Upload Flaws Reveal About CMS Defense

What Happened Two Joomla extensions, iCagenda and Balbooa Forms, contained critical file upload vulnerabilities that attackers exploited before patches were available. CVE-2026-48939 (iCagenda) and CV

For Security EngineersRead

Cisco Finds Memory Leak in Claude's Prompt Cache

Incident

4 min read

Cisco Finds Memory Leak in Claude's Prompt Cache

What Happened Cisco s security research team discovered a vulnerability in Anthropic s Claude AI system that allowed unauthorized access to cached conversation memories. This flaw let attackers retrie

For Security EngineersRead

Incident

4 min read

AI Agent Granted AWS Admin: Teardown

Your marketing team deployed an AI agent to automate social media responses. Three days later, your security team discovered it had spun up 47 EC2 instances in regions you don t use, racked up $23,000

For Compliance TeamsRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Incident

4 min read

Six AI Assistants, One Old Trick

You clone a repository. Your AI coding assistant reads the files to understand context. Within seconds, it s reading your SSH keys, environment variables, or internal documentation. No exploit kit req

For Security EngineersRead

Zimbra XSS Flaw: When Patch Management Becomes Crisis Response

Incident

4 min read

Zimbra XSS Flaw: When Patch Management Becomes Crisis Response

What Happened Zimbra released version 10.1.19 to fix a critical stored cross-site scripting (XSS) vulnerability in its Classic Web Client. Google s Threat Analysis Group reported the flaw, highlightin

For Security EngineersRead

Dormant GitHub Accounts Map Your Org Structure

Incident

4 min read

Dormant GitHub Accounts Map Your Org Structure

What Happened Datadog Security Labs identified coordinated reconnaissance campaigns using over 50 dormant GitHub accounts to map corporate organizations. Attackers issued API queries through accounts

For Security EngineersRead

Zimbra's Stored XSS Flaw: When Email Becomes an Execution Engine

Incident

4 min read

Zimbra's Stored XSS Flaw: When Email Becomes an Execution Engine

What Happened Zimbra disclosed a stored cross-site scripting (XSS) vulnerability in its Classic Web Client. This flaw allows specially crafted emails to execute malicious scripts in a user s session.

For Security EngineersRead

Incident

4 min read

3,000 Components, Zero Visibility

What Happened A mid-market SaaS company discovered unauthorized data access in their production environment. The entry point wasn t their code. An attacker exploited a known vulnerability in a third-p

For Security EngineersRead

Zero-CVE Package Became the Attack Vector

Incident

4 min read

Zero-CVE Package Became the Attack Vector

What Happened A software supply chain compromise occurred when your team integrated what appeared to be a clean open-source dependency. The package showed zero CVEs in your security scanning tools. Th

For Security EngineersRead

AI Code Reviewers Missed This Attack 79 Times

Incident

4 min read

AI Code Reviewers Missed This Attack 79 Times

A research team at the University of Missouri-Kansas City has published proof-of-concept code for an attack that bypasses AI code review tools by hiding malicious instructions inside PNG files attache

For Security EngineersRead

Injective Labs Supply Chain Attack: 18 Packages Compromised in 24 Hours

Incident

4 min read

Injective Labs Supply Chain Attack: 18 Packages Compromised in 24 Hours

What Happened On July 8, 2026, a threat actor published version 1.20.21 of @injectivelabs/sdk-ts to npm. The package contained code to steal cryptocurrency wallet private keys. Within 24 hours, the at

For Security EngineersRead

Gitea Auth Bypass: One Header, Full Admin

Incident

4 min read

Gitea Auth Bypass: One Header, Full Admin

On January 14, 2025, security researcher Michael Clark confirmed what Sysdig had already detected: attackers were exploiting CVE-2026-20896 to bypass authentication in Gitea Docker deployments. This v

For Security EngineersRead

82% of Orgs Carry Debt They Can't Pay Down

Incident

3 min read

82% of Orgs Carry Debt They Can't Pay Down

The Problem Organizations are facing a systemic issue: 82% carry security debt, meaning they have unresolved vulnerabilities older than a year. These aren t hypothetical risks; they re real flaws in y

For CISOsRead

Seven Ubiquiti Flaws Exposed 100,000 Devices

Incident

4 min read

Seven Ubiquiti Flaws Exposed 100,000 Devices

Ubiquiti recently released security updates for UniFi OS, addressing seven critical vulnerabilities. One of these, CVE-2026-50746, has a maximum CVSS severity score. Censys data shows over 100,000 Uni

For Security EngineersRead

Incident

4 min read

1.8M Malicious Packages in Six Months

What Happened By the end of Q2 2026, Sonatype Research logged 1.8 million malicious packages across public registries. This wasn t a single sophisticated attack. It was industrial-scale pollution of t

For Security EngineersRead

Showing 97-112 of 707 articles

PreviousPage 7 of 45Next