Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams149 Security Engineers149 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All149 Incident149 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

149 articles in Incident · Clear filtersSort byNewest·Trending

OAuth2-proxy Authentication Bypass: A Header Smuggling Breakdown

Incident

Latest

4 min read

OAuth2-proxy Authentication Bypass: A Header Smuggling Breakdown

A single HTTP header with an underscore instead of a hyphen bypassed authentication for an entire OAuth2-proxy deployment. No brute force. No stolen credentials. Just X_Forwarded_User instead of X-For

For Security EngineersRead article

26 Malicious npm Packages: A Supply Chain Attack Breakdown

Incident

4 min read

26 Malicious npm Packages: A Supply Chain Attack Breakdown

What Happened A recent campaign by the North Korean threat actor group Famous Chollima involved the publication of 26 malicious packages to the npm registry. These packages deployed a cross-platform r

For Compliance TeamsRead

1.45 Billion Attacks: How SMBs Became the Primary Target for API Exploits

Incident

4 min read

1.45 Billion Attacks: How SMBs Became the Primary Target for API Exploits

The Surge in API Attacks In the first half of 2025, small and medium-sized businesses (SMBs) faced over 1.45 billion attacks, with API-targeted exploits increasing 74 times compared to previous period

For Compliance TeamsRead

When AI Pentesting Tools Miss What Matters: A Burp AI Case Study

Incident

3 min read

When AI Pentesting Tools Miss What Matters: A Burp AI Case Study

Understanding the Gap in AI Pentesting CyberMaddy, a security researcher, evaluated Burp AI s vulnerability detection capabilities using test web applications. The tool identified common vulnerabiliti

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

A Zero-Width Space Character Broke FreeScout's Security

Incident

4 min read

A Zero-Width Space Character Broke FreeScout's Security

What Happened OX Security discovered CVE-2026-28289 , a zero-click remote code execution vulnerability in FreeScout, an open-source helpdesk platform. This flaw allowed attackers to execute arbitrary

For Security EngineersRead

Zero-Day in 1.4 Billion Devices: The Qualcomm CVE-2026-21385 Exploit

Incident

4 min read

Zero-Day in 1.4 Billion Devices: The Qualcomm CVE-2026-21385 Exploit

What Happened Threat actors exploited CVE-2026-21385 , a high-severity memory corruption vulnerability in Qualcomm chipsets, in targeted attacks against Android devices. Security researchers identifie

For Security EngineersRead

Spy-Grade iOS Exploit Kit Now Powering Financial Crime

Incident

4 min read

Spy-Grade iOS Exploit Kit Now Powering Financial Crime

What Happened Between February and late 2025, threat actors deployed Coruna—an iOS exploit kit containing five complete exploit chains and 23 individual exploits—against targets ranging from iPhone mo

For Security EngineersRead

Zero-Click RCE in FreeScout: When Your Help Desk Becomes the Entry Point

Incident

3 min read

Zero-Click RCE in FreeScout: When Your Help Desk Becomes the Entry Point

Overview of the Vulnerability Security researchers at OX Security disclosed CVE-2026-28289 , a critical vulnerability in FreeScout, an open-source, self-hosted help desk platform. This flaw allows una

For Security EngineersRead

When Static Scans Miss the Exploit Path: A Shift-Left Failure

Incident

5 min read

When Static Scans Miss the Exploit Path: A Shift-Left Failure

What Happened Your team might face a critical vulnerability in production that your CI/CD security pipeline had previously scanned and cleared. Consider a SQL injection flaw in a user authentication e

For DevOps LeadersRead

Two Years of AI Infrastructure Exploitation: What Wiz Researchers Found

Incident

3 min read

Two Years of AI Infrastructure Exploitation: What Wiz Researchers Found

Overview of Findings Security researchers at Wiz spent two years examining AI infrastructure deployments to uncover exploitable vulnerabilities. Their findings reveal that while many teams focus on pr

For Security EngineersRead

When Your AI Coding Assistant Becomes an Exfiltration Tool

Incident

4 min read

When Your AI Coding Assistant Becomes an Exfiltration Tool

Incident Overview Orca Security discovered RoguePilot, a vulnerability in GitHub Codespaces that allowed attackers to manipulate GitHub Copilot into leaking GITHUB_TOKEN credentials. Attackers embedde

For Security EngineersRead

A Financial Services Team Discovers Their Load Balancer Is the Weakest Link

Incident

4 min read

A Financial Services Team Discovers Their Load Balancer Is the Weakest Link

The Challenge A financial services organization believed they had a robust security architecture with WAFs , application-layer security controls, runtime protection, and comprehensive monitoring. Howe

For Security EngineersRead

OAuth Error Flow Attacks Hit Government Networks: A Technical Breakdown

Incident

4 min read

OAuth Error Flow Attacks Hit Government Networks: A Technical Breakdown

Attack Overview Attackers have targeted government and public-sector organizations by exploiting OAuth 2.0 s error handling mechanisms. The attack began with phishing emails containing malicious links

For Security EngineersRead

4,000 Downloads in Eight Hours: Anatomy of the Cline CLI Supply Chain Attack

Incident

5 min read

4,000 Downloads in Eight Hours: Anatomy of the Cline CLI Supply Chain Attack

What Happened On February 17, 2026, an attacker exploited a compromised npm publish token to release Cline CLI version 2.3.0, an unauthorized update that installed OpenClaw on developer systems. This

For Security EngineersRead

87% of Production Services Run Exploitable Dependencies

Incident

3 min read

87% of Production Services Run Exploitable Dependencies

The Problem: Widespread Vulnerabilities According to Datadog s State of DevSecOps 2026 report, 87% of organizations are running at least one exploitable vulnerability in their production services. The

For DevOps LeadersRead

Incident

3 min read

OAuth Credentials Stored as Executable HTML: The n8n XSS Incident

Overview of the Incident On February 6, n8n released version 2.6.4 to address a stored cross-site scripting (XSS) vulnerability in its handling of OAuth credentials. Security researchers at Imperva fo

For Security EngineersRead

Showing 113-128 of 149 articles

PreviousPage 8 of 10Next