Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams149 Security Engineers149 Compliance Teams99 Developers27 DevOps Leaders15 CISOs6 IT Directors2

Topics:All149 Incident149 Standards81 General33 Guides15 Research12 Vendor News4 Deadlines2 Legal2

149 articles in Incident · Clear filtersSort byNewest·Trending

A Threat Intelligence Program That Couldn't Detect Threats

Incident

Latest

4 min read

A Threat Intelligence Program That Couldn't Detect Threats

Your security team invested in threat intelligence feeds, built a threat modeling framework, and ran quarterly vulnerability assessments. Yet, an adversary exploited a gap you d documented but never v

For Security EngineersRead article

Critical OpenClaw Vulnerability Exposes the Gap Between AI Tool Adoption and Security Readiness

Incident

4 min read

Critical OpenClaw Vulnerability Exposes the Gap Between AI Tool Adoption and Security Readiness

What Happened OpenClaw , an AI-powered development tool widely adopted by developers, recently disclosed and patched a critical vulnerability. This flaw was present in a tool actively integrated into

For DevelopersRead

2,863 Google Cloud Keys Became Auth Tokens Without Warning

Incident

5 min read

2,863 Google Cloud Keys Became Auth Tokens Without Warning

What Happened In late 2024, Truffle Security discovered 2,863 live Google Cloud API keys exposed in public repositories. These weren t stolen credentials or phishing victims—they were legitimate billi

For Compliance TeamsRead

When AI Agents Outpaced Every Human Researcher Combined

Incident

3 min read

When AI Agents Outpaced Every Human Researcher Combined

AI s Impact on Vulnerability Discovery In a 90-day period, an AI agent named XBOW submitted over 1,060 valid vulnerabilities to bug bounty programs, surpassing the combined efforts of thousands of hum

For Compliance TeamsRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Malicious Next.js Repos Triggered Backdoors in VS Code

Incident

4 min read

Malicious Next.js Repos Triggered Backdoors in VS Code

What Happened Microsoft identified a campaign distributing malicious repositories disguised as legitimate Next.js projects. The attack exploited Visual Studio Code s workspace automation features to e

For DevelopersRead

A Calendar Invite Hijacked an AI Browser: The PerplexedComet Breakdown

Incident

5 min read

A Calendar Invite Hijacked an AI Browser: The PerplexedComet Breakdown

What Happened In October 2024, security researchers at Zenity discovered a zero-click vulnerability in Perplexity s Comet AI browser. The flaw, named PerplexedComet, allowed attackers to inject malici

For Compliance TeamsRead

ClawJacked: How a Browser Tab Hijacked an AI Platform Through Localhost

Incident

4 min read

ClawJacked: How a Browser Tab Hijacked an AI Platform Through Localhost

What Happened OpenClaw, a self-hosted AI platform, had a vulnerability that allowed malicious websites to hijack local instances through brute-force password attacks. The attack was simple: a user vis

For Security EngineersRead

Incident

5 min read

3,000 API Keys Found in Public Code: A Google Cloud Incident Analysis

What Happened Truffle Security discovered nearly 3,000 Google Cloud API keys embedded in publicly accessible client-side code. These keys provided unauthorized access to Google s Gemini API endpoints,

For Compliance TeamsRead

Compromised npm Package Installed OpenClaw on 90,000 Weekly Downloads

Incident

4 min read

Compromised npm Package Installed OpenClaw on 90,000 Weekly Downloads

What Happened A threat actor compromised the Cline CLI package on npm and modified it to silently install OpenClaw—an AI coding agent—on developer machines without consent. The malicious version was l

For Compliance TeamsRead

The API Key That Gave Away the Store: An LLM Endpoint Breach Teardown

Incident

5 min read

The API Key That Gave Away the Store: An LLM Endpoint Breach Teardown

What Happened Your development team deployed an internal LLM service with an exposed API endpoint for rapid prototyping. The endpoint used a hardcoded API key with broad permissions to access the orga

For Security EngineersRead

An AI Bot Published a Malicious npm Package for Eight Hours

Incident

4 min read

An AI Bot Published a Malicious npm Package for Eight Hours

On a Tuesday morning, developers running npm update unknowingly downloaded [email protected] — an unauthorized release published without human approval. The package remained live for eight hours, during whi

For Security EngineersRead

The Calendar Invitation That Hijacked an AI Agent

Incident

4 min read

The Calendar Invitation That Hijacked an AI Agent

What Happened Researchers demonstrated a successful promptware attack against Google s AI systems using a simple calendar invitation. The attack began when an AI agent processed a malicious Google Cal

For Security EngineersRead

How Log4j Breaches Still Happen Three Years Later

Incident

4 min read

How Log4j Breaches Still Happen Three Years Later

Persistent Vulnerabilities Log4j vulnerabilities continue to surface in security assessments across production environments in 2024, despite the CVE-2021-44228 disclosure in December 2021. Your team m

For DevelopersRead

When Static Analysis Flagged 847 Vulnerabilities (But Only 3 Were Real)

Incident

4 min read

When Static Analysis Flagged 847 Vulnerabilities (But Only 3 Were Real)

The Problem A mid-sized fintech company s security team spent three weeks triaging 847 vulnerabilities flagged by their static analysis tool during a pre-release audit. After manual investigation, the

For Security EngineersRead

When Vulnerability Scanning and Patch Deployment Don't Talk to Each Other

Incident

4 min read

When Vulnerability Scanning and Patch Deployment Don't Talk to Each Other

The Problem A mid-sized financial services company found a critical authentication bypass vulnerability in their customer portal during a routine scan. The vulnerability management team logged it, ass

For Security EngineersRead

How a Vault License Change Exposed a Secrets Management Crisis

Incident

4 min read

How a Vault License Change Exposed a Secrets Management Crisis

What Happened In August 2023, HashiCorp transitioned Vault from the Mozilla Public License to the Business Source License (B.S.L.). This change didn t cause a data breach, but it revealed a critical i

For Security EngineersRead

Showing 129-144 of 149 articles

PreviousPage 9 of 10Next