Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams142 Security Engineers142 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All142 Incident142 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

142 articles in Incident · Clear filtersSort byNewest·Trending

AI Agent Turned Exfiltration Tool: The PleaseFix Vulnerability

Incident

Latest

5 min read

AI Agent Turned Exfiltration Tool: The PleaseFix Vulnerability

Your AI browser agent just accessed your local file system, read your credentials, and sent them to an attacker. You didn t click anything. You didn t approve any action. The agent did it autonomously

For Security EngineersRead article

1,000 SaaS Environments Compromised Through a Security Scanner

Incident

4 min read

1,000 SaaS Environments Compromised Through a Security Scanner

What Happened Between late 2024 and early 2025, attackers compromised the Trivy vulnerability scanner s supply chain by stealing npm publish tokens. They backdoored more than 29 packages that Trivy de

For Compliance TeamsRead

15,000 Magento Stores Hit by Defacement: PolyShell Vulnerability Teardown

Incident

4 min read

15,000 Magento Stores Hit by Defacement: PolyShell Vulnerability Teardown

What Happened Security researchers at Sansec discovered a critical vulnerability in Magento s REST API, designated PolyShell, that allows attackers to upload malicious files to e-commerce sites withou

For Compliance TeamsRead

AppsFlyer SDK Compromise: How a Marketing Tool Became a Cryptocurrency Theft Vector

Incident

5 min read

AppsFlyer SDK Compromise: How a Marketing Tool Became a Cryptocurrency Theft Vector

What Happened Between March 9 and March 11, 2025, attackers compromised the AppsFlyer Web SDK, injecting malicious JavaScript to steal cryptocurrency. The code targeted cryptocurrency wallet addresses

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Trivy Scanner Breach: When 32,000 GitHub Stars Became a Liability

Incident

4 min read

Trivy Scanner Breach: When 32,000 GitHub Stars Became a Liability

What Happened On March 19, 2026, attackers compromised Aqua Security s Trivy vulnerability scanner through GitHub Actions. Trivy, with over 32,000 stars on GitHub, is a critical dependency in thousand

For Compliance TeamsRead

Angular SSR Vulnerability Exposes Internal Networks Through Header Manipulation

Incident

3 min read

Angular SSR Vulnerability Exposes Internal Networks Through Header Manipulation

Your Angular application can inadvertently become a tool for attackers to map your internal infrastructure. CVE-2026-27739 highlights how a single oversight in HTTP header validation can turn server-s

For DevelopersRead

AI Scanner Misses SQL Injection in Payment Flow — A Case Study in Tool Limitations

Incident

4 min read

AI Scanner Misses SQL Injection in Payment Flow — A Case Study in Tool Limitations

What Happened A Series B fintech company integrated an AI-powered vulnerability scanner into their CI/CD pipeline to reduce false positives from their previous SAST tool. The AI scanner was part of a

For Security EngineersRead

83,000 Downloads of a Critical Auth Bypass in One Week

Incident

4 min read

83,000 Downloads of a Critical Auth Bypass in One Week

What Happened On January 15, 2025, researchers disclosed CVE-2026-29000 , a critical authentication bypass vulnerability in pac4j-jwt, a widely-used Java authentication library. The flaw affects the J

For Security EngineersRead

AI Agent Leaked Customer PII Through Autonomous Email Actions

Incident

5 min read

AI Agent Leaked Customer PII Through Autonomous Email Actions

What Happened Your organization deployed an AI agent with broad permissions to handle customer support inquiries. This agent was set up to autonomously draft and send email responses, access customer

For Security EngineersRead

OAuth2-proxy Authentication Bypass: A Header Smuggling Breakdown

Incident

4 min read

OAuth2-proxy Authentication Bypass: A Header Smuggling Breakdown

A single HTTP header with an underscore instead of a hyphen bypassed authentication for an entire OAuth2-proxy deployment. No brute force. No stolen credentials. Just X_Forwarded_User instead of X-For

For Security EngineersRead

26 Malicious npm Packages: A Supply Chain Attack Breakdown

Incident

4 min read

26 Malicious npm Packages: A Supply Chain Attack Breakdown

What Happened A recent campaign by the North Korean threat actor group Famous Chollima involved the publication of 26 malicious packages to the npm registry. These packages deployed a cross-platform r

For Compliance TeamsRead

1.45 Billion Attacks: How SMBs Became the Primary Target for API Exploits

Incident

4 min read

1.45 Billion Attacks: How SMBs Became the Primary Target for API Exploits

The Surge in API Attacks In the first half of 2025, small and medium-sized businesses (SMBs) faced over 1.45 billion attacks, with API-targeted exploits increasing 74 times compared to previous period

For Compliance TeamsRead

When AI Pentesting Tools Miss What Matters: A Burp AI Case Study

Incident

3 min read

When AI Pentesting Tools Miss What Matters: A Burp AI Case Study

Understanding the Gap in AI Pentesting CyberMaddy, a security researcher, evaluated Burp AI s vulnerability detection capabilities using test web applications. The tool identified common vulnerabiliti

For Security EngineersRead

A Zero-Width Space Character Broke FreeScout's Security

Incident

4 min read

A Zero-Width Space Character Broke FreeScout's Security

What Happened OX Security discovered CVE-2026-28289 , a zero-click remote code execution vulnerability in FreeScout, an open-source helpdesk platform. This flaw allowed attackers to execute arbitrary

For Security EngineersRead

Zero-Day in 1.4 Billion Devices: The Qualcomm CVE-2026-21385 Exploit

Incident

4 min read

Zero-Day in 1.4 Billion Devices: The Qualcomm CVE-2026-21385 Exploit

What Happened Threat actors exploited CVE-2026-21385 , a high-severity memory corruption vulnerability in Qualcomm chipsets, in targeted attacks against Android devices. Security researchers identifie

For Security EngineersRead

Spy-Grade iOS Exploit Kit Now Powering Financial Crime

Incident

4 min read

Spy-Grade iOS Exploit Kit Now Powering Financial Crime

What Happened Between February and late 2025, threat actors deployed Coruna—an iOS exploit kit containing five complete exploit chains and 23 individual exploits—against targets ranging from iPhone mo

For Security EngineersRead

Showing 97-112 of 142 articles

PreviousPage 7 of 9Next