Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams298 Security Engineers149 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All298 Incident149 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

298 articlesSort byNewest·Trending

Stop Patching Every CVE: A Checklist for Impact-Based Vulnerability Management

Standards

Latest

5 min read

Stop Patching Every CVE: A Checklist for Impact-Based Vulnerability Management

You ve seen the reports. NIST has changed the way it prioritizes software flaws in its CVE framework. The shift is clear: focus on high-impact vulnerabilities, not just volume. This isn t about abando

For Compliance TeamsRead article

NIST Just Handed You the CVE Problem—Here's What Happened Next

Standards

5 min read

NIST Just Handed You the CVE Problem—Here's What Happened Next

The Challenge Between 2020 and 2023, CVE submissions grew 263%. Last year alone, NIST enriched almost 42,000 CVEs—a 45% year-over-year increase. Then NIST announced it would no longer analyze every vu

For Security EngineersRead

What We're Learning About AI Vulnerability Scanners (And What We're Not)

Standards

5 min read

What We're Learning About AI Vulnerability Scanners (And What We're Not)

Over the past month, I ve encountered the same set of questions in multiple forums, all centering on Anthropic s Claude Mythos—an AI model that claims to find and weaponize vulnerabilities at an unpre

For Compliance TeamsRead

Patching the protobuf.js RCE Vulnerability: A Step-by-Step Response Plan

Standards

4 min read

Patching the protobuf.js RCE Vulnerability: A Step-by-Step Response Plan

A remote code execution vulnerability in protobuf.js (GHSA-xq3m-2v4x-88gg) affecting versions 8.0.0/7.5.4 and lower allows attackers to inject malicious code through unsafe dynamic code generation. If

For DevelopersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

91,000 Attack Sessions in Three Months: The Ollama Exposure Problem

Incident

5 min read

91,000 Attack Sessions in Three Months: The Ollama Exposure Problem

What Happened Between October 2025 and January 2026, GreyNoise captured 91,403 distinct attack sessions targeting publicly exposed LLM inference endpoints. The primary target was Ollama instances depl

For Security EngineersRead

CVE-2026-33032: When an AI Feature Became a Remote Code Execution Vector

Incident

3 min read

CVE-2026-33032: When an AI Feature Became a Remote Code Execution Vector

Overview of the Vulnerability On March 30, security researchers at Pluto Security disclosed CVE-2026-33032 , a critical vulnerability in nginx UI, a popular web-based management tool for nginx servers

For Security EngineersRead

Prompt Injection Flaws in Salesforce Agentforce and Microsoft Copilot: A Security Teardown

Incident

4 min read

Prompt Injection Flaws in Salesforce Agentforce and Microsoft Copilot: A Security Teardown

Two recently fixed prompt injection vulnerabilities in Salesforce Agentforce and Microsoft Copilot could have allowed external attackers to leak sensitive data from enterprise systems. Here s what hap

For Compliance TeamsRead

21,764 Malicious Packages: The axios Compromise and What It Reveals About Your Dependency Chain

Incident

4 min read

21,764 Malicious Packages: The axios Compromise and What It Reveals About Your Dependency Chain

What Happened In Q1 2026, Sonatype identified 21,764 open source malware packages across public repositories, with npm accounting for 75% of these. Three incidents highlighted how attackers exploit tr

For Security EngineersRead

Docker AuthZ Bypass: Which Plugin Architecture Should You Deploy?

Standards

5 min read

Docker AuthZ Bypass: Which Plugin Architecture Should You Deploy?

CVE-2026-34040 scored 8.8 on the CVSS scale. It s a regression of vulnerabilities patched in 2019 and 2024. The fix is available in Docker Engine 29.3.1 and Docker Desktop 4.66.1. The real question is

For DevOps LeadersRead

North Korean Actors Compromised Axios npm Package: A Supply Chain Attack Teardown

Incident

3 min read

North Korean Actors Compromised Axios npm Package: A Supply Chain Attack Teardown

A recent compromise of the popular Axios npm package has highlighted critical gaps in supply chain security for software development teams. Google s Threat Intelligence Group attributed the breach of

For Security EngineersRead

Integrating AI Vulnerability Scanners Into Your Security Pipeline

Standards

4 min read

Integrating AI Vulnerability Scanners Into Your Security Pipeline

Your vulnerability management program is about to undergo a significant transformation. AI models that autonomously discover vulnerabilities at scale are now production tools. Your team needs a deploy

For Security EngineersRead

When Your Publisher Account Gets Suspended: Maintaining Critical Update Channels

General

5 min read

When Your Publisher Account Gets Suspended: Maintaining Critical Update Channels

Scope This guide addresses the operational and security risks when your team s publishing accounts—such as Microsoft Partner Center, Apple Developer, and Google Play Console—face suspension or access

For Compliance TeamsRead

Axios NPM Package Hijacked: Three Hours That Exposed Your Dependency Stack

Incident

5 min read

Axios NPM Package Hijacked: Three Hours That Exposed Your Dependency Stack

What Happened On March 30, 2026, attackers compromised the Axios NPM package by taking over a maintainer s account. Axios, a widely used HTTP client library in JavaScript, was injected with malicious

For Compliance TeamsRead

How Stolen Credentials Turned GitHub Actions Into a Malware Factory

Incident

5 min read

How Stolen Credentials Turned GitHub Actions Into a Malware Factory

What Happened TeamPCP compromised the CI/CD pipeline for Trivy, a widely-used vulnerability scanner, by stealing publishing credentials. They used these credentials to push malicious versions of both

For DevOps LeadersRead

Audio Steganography in Package Attacks: Detection and Response Guide

Standards

4 min read

Audio Steganography in Package Attacks: Detection and Response Guide

Scope This guide focuses on detecting and mitigating supply chain attacks that use audio steganography to hide malicious payloads in software packages. Our case study is the March 27, 2026 compromise

For Security EngineersRead

36 Malicious npm Packages Deployed Reverse Shells Through Strapi Plugin Typosquatting

Incident

4 min read

36 Malicious npm Packages Deployed Reverse Shells Through Strapi Plugin Typosquatting

What Happened SafeDep discovered 36 malicious npm packages posing as legitimate Strapi CMS plugins. These packages exploited Redis and PostgreSQL connections to deploy reverse shells and steal credent

For Security EngineersRead

Showing 129-144 of 298 articles

PreviousPage 9 of 19Next