Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1443 Security Engineers1023 Compliance Teams275 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All1443 Incident914 General270 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

1443 articlesSort byNewest·Trending

4,000 Downloads of Malicious Code: The Cline npm Package Compromise

Incident

Latest

4 min read

4,000 Downloads of Malicious Code: The Cline npm Package Compromise

What Happened The npm package Cline version 2.3.0 was compromised with malicious code that installed OpenClaw, a backdoor tool, on developer machines. This version was downloaded over 4,000 times befo

For Security EngineersRead article

AI-Generated Malware in Your Dependencies: Detection Checklist

Standards

5 min read

AI-Generated Malware in Your Dependencies: Detection Checklist

A recent campaign distributing over 300 poisoned packages shows how attackers now use AI to scale supply chain attacks. Your dependency scanning probably caught the known signatures, but it won t catc

For Security EngineersRead

Authentication Bypass in pac4j-jwt Exposes Java Applications

Incident

5 min read

Authentication Bypass in pac4j-jwt Exposes Java Applications

What Happened CVE-2026-29000, a critical authentication bypass vulnerability in the pac4j-jwt library, allows attackers to bypass authentication controls in Java applications. The flaw was identified

For Security EngineersRead

AI Agent Turned Exfiltration Tool: The PleaseFix Vulnerability

Incident

5 min read

AI Agent Turned Exfiltration Tool: The PleaseFix Vulnerability

Your AI browser agent just accessed your local file system, read your credentials, and sent them to an attacker. You didn t click anything. You didn t approve any action. The agent did it autonomously

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

1,000 SaaS Environments Compromised Through a Security Scanner

Incident

4 min read

1,000 SaaS Environments Compromised Through a Security Scanner

What Happened Between late 2024 and early 2025, attackers compromised the Trivy vulnerability scanner s supply chain by stealing npm publish tokens. They backdoored more than 29 packages that Trivy de

For Compliance TeamsRead

15,000 Magento Stores Hit by Defacement: PolyShell Vulnerability Teardown

Incident

4 min read

15,000 Magento Stores Hit by Defacement: PolyShell Vulnerability Teardown

What Happened Security researchers at Sansec discovered a critical vulnerability in Magento s REST API, designated PolyShell, that allows attackers to upload malicious files to e-commerce sites withou

For Compliance TeamsRead

AI Component Inventory Template: Mapping Your LLM Dependencies in 72 Hours

Standards

6 min read

AI Component Inventory Template: Mapping Your LLM Dependencies in 72 Hours

The Pentagon s 180-day deadline to remove Anthropic technology exposes a fundamental gap: most organizations cannot precisely answer, where do we use AI? Only 31% of organizations report being fully e

For CISOsRead

"Wait, this package is suddenly asking for what permissions?"

Standards

5 min read

"Wait, this package is suddenly asking for what permissions?"

These questions started showing up in security Slack channels right after StepSecurity flagged two hijacked npm packages in the React Native ecosystem. These packages, with over 30,000 downloads per w

For Security EngineersRead

Securing Your Dependency Chain Against Malicious Extensions

Research

5 min read

Securing Your Dependency Chain Against Malicious Extensions

Your build pulls in 847 dependencies. One of them just downloaded your AWS credentials. Researchers have identified dozens of malicious GlassWorm extensions in the wild, each iteration more sophistica

For Security EngineersRead

AppsFlyer SDK Compromise: How a Marketing Tool Became a Cryptocurrency Theft Vector

Incident

5 min read

AppsFlyer SDK Compromise: How a Marketing Tool Became a Cryptocurrency Theft Vector

What Happened Between March 9 and March 11, 2025, attackers compromised the AppsFlyer Web SDK, injecting malicious JavaScript to steal cryptocurrency. The code targeted cryptocurrency wallet addresses

For Security EngineersRead

88 Malicious npm Packages Still Active: What the PhantomRaven Data Tells Us

Standards

4 min read

88 Malicious npm Packages Still Active: What the PhantomRaven Data Tells Us

Endor Labs researchers have identified 88 new malicious npm packages in the latest PhantomRaven campaign—81 of which are still available for download. These packages are actively stealing credentials

For Security EngineersRead

Stopping Self-Spreading Worms When You Can't Kill the Server

Standards

4 min read

Stopping Self-Spreading Worms When You Can't Kill the Server

On March 20, 2026, Aikido Security detected CanisterWorm spreading across the npm ecosystem. Within hours, it had compromised more than 50 packages across multiple scopes. The attack used the Internet

For Security EngineersRead

Trivy Scanner Breach: When 32,000 GitHub Stars Became a Liability

Incident

4 min read

Trivy Scanner Breach: When 32,000 GitHub Stars Became a Liability

What Happened On March 19, 2026, attackers compromised Aqua Security s Trivy vulnerability scanner through GitHub Actions. Trivy, with over 32,000 stars on GitHub, is a critical dependency in thousand

For Compliance TeamsRead

Defending Against Decentralized Malware: What the CanisterWorm Attack Means for Your Supply Chain

Standards

5 min read

Defending Against Decentralized Malware: What the CanisterWorm Attack Means for Your Supply Chain

Scope This guide covers detection and mitigation strategies for supply chain attacks using decentralized infrastructure for command-and-control operations. You ll learn to identify compromised package

For Security EngineersRead

AI Agents Aren't Just Fancy Chatbots: 5 Security Myths That Will Get You Breached

General

5 min read

AI Agents Aren't Just Fancy Chatbots: 5 Security Myths That Will Get You Breached

Your security team might think of AI agents like web applications, but this assumption creates a new attack surface. When CNCERT warned about OpenClaw s vulnerabilities—specifically its inherently wea

For Security EngineersRead

Angular SSR Vulnerability Exposes Internal Networks Through Header Manipulation

Incident

3 min read

Angular SSR Vulnerability Exposes Internal Networks Through Header Manipulation

Your Angular application can inadvertently become a tool for attackers to map your internal infrastructure. CVE-2026-27739 highlights how a single oversight in HTTP header validation can turn server-s

For DevelopersRead

Showing 1297-1312 of 1443 articles

PreviousPage 82 of 91Next