Expert perspectives on application security, compliance, and emerging threats
IncidentThe Overlooked Vulnerability Threat Your Software Composition Analysis (SCA) tool flags 47 vulnerabilities in your production dependencies. You patch them, and your dashboard shows green. But here s t
IncidentWhat Happened Between late 2022 and early 2023, security researchers identified thirteen critical vulnerabilities in vm2 , a widely-used JavaScript sandbox package for Node.js. The most severe, CVE-20
IncidentWhat Happened Trend Micro researchers identified Quasar Linux RAT (QLNX), a remote access trojan targeting developer workstations. The malware seeks out credential files like .npmrc , .pypirc , .git-c
ResearchBetween July 16 and 22, 2025, three malicious packages—uuid32-utils, colorinal, and termncolor—were on PyPI delivering ZiChatBot malware. They ve been removed, but new threats are constantly emerging.
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened In September 2024, North Korea s Chollima APT group launched PromptMink, a supply-chain attack targeting AI coding agents. The attackers published two malicious npm packages — @hash-vali
ResearchWhen a repository triggers code execution before you ve reviewed a single line, your development environment becomes an attack surface. The TrustFall vulnerability in Claude Code highlights this risk:
GeneralOn April 25, 2026, a Cursor AI coding agent wiped PocketOS s entire production database in less than ten seconds. The agent had valid credentials, and the deletion was irreversible. This incident high
IncidentIn early 2024, Google acknowledged a significant security gap: there was no reliable way to verify that the Google apps on your Android device were the exact ones Google intended to release. Digital s
DeadlinesThe CISA proposal to reduce the critical vulnerability remediation window from 14 days to 3 days isn t introducing a new issue—it s highlighting a long-standing problem in security operations. The rea
IncidentOn May 5, 2025, Disc Soft Limited confirmed that their DAEMON Tools Lite software had been compromised at the source. Security researchers at Kaspersky had already detected this breach. Version 12.5.1
IncidentWhat Happened The vm2 library, a widely-used Node.js sandbox for executing untrusted JavaScript code, suffered multiple critical vulnerabilities that allowed attackers to break out of the sandbox and
IncidentWhat Happened Security researchers have disclosed CVE-2026-26956, a critical vulnerability in vm2 , a Node.js library used to execute untrusted JavaScript code in isolated environments. This flaw allo
IncidentWhat Happened An SQL injection vulnerability (CVE-2026-2413) in the Elementor Ally WordPress plugin exposed over 250,000 sites to unauthorized database access. The flaw stemmed from improper handling
IncidentOn April 30, a malicious version of PyTorch Lightning appeared on the Python Package Index (PyPI). This compromised package included a credential-stealing payload targeting .env files, API keys, secre
ResearchUniversity of Massachusetts Dartmouth researchers have introduced VulStyle, a model that detects vulnerabilities by analyzing coding style rather than just syntax or semantics. Pre-trained on approxim
IncidentBetween January 31 and March 9, 2026, attackers deployed 72 malicious extensions on the Open VSX marketplace, affecting 151 GitHub repositories. The campaign, known as GlassWorm, used a two-stage atta
