Category
88 articles in Cybersecurity.
About this section
Security writing splits into two unhelpful piles: vendor content that ends in a product, and incident coverage that ends in alarm. What is missing is the middle, which is what a small engineering team should actually do on a Tuesday. That is what this section aims at. Breakdowns of real incidents with the part that matters to your codebase pulled out, compliance work described by someone who has been through the audit rather than sold it, and honest coverage of the new attack surface that AI tooling has opened, including in the tools we use ourselves. Where the responsible advice is that a risk does not apply to you at your size, we say that, because a checklist written for an enterprise is a good way for a five-person team to spend a month on the wrong thing.
All 88 articles
P.01An unauthenticated attacker can inject code through a GitLab GraphQL directive and delete or modify public projects and user data. CVSS 9.4, patched in 19.2.4. Here's what's affected and how to check your instance.
P.02Two unrelated companies disclosed breaches in the same week, both tracing back to a vulnerability in Metabase, the business intelligence tool their vendors used. Here's what happened, how it lines up with the CVE we covered days earlier, and what to actually check.
P.03Two critical, unauthenticated vCenter flaws let attackers bypass login entirely and run code on the management plane. Exploitation started five days after the patch shipped. Here's what's affected and how to check for compromise.
P.04A hack at shipping giant Ceva Logistics that started July 29 has exposed customer data for Bol, ING, Ajax, Ace & Tate, and Valve's Steam hardware buyers, none of whom were breached directly. Here's what happened and what it means for how you assess vendor risk.
P.05A stack-based buffer overflow in Windows DNS Server lets an unauthenticated attacker run code with a single crafted packet, no user interaction required. It hasn't been seen exploited yet, but it has the exact shape of a bug that gets weaponized fast. Here's what to patch and in what order.
P.06A use-after-free in Windows' AFD.sys networking driver is on CISA's Known Exploited Vulnerabilities list with an August 25 deadline. Lazarus has been using it since July to hit defense contractors. Here's what it is and what to patch.
P.07A single unauthenticated HTTP request can reload Cisco ASA and FTD devices with remote-access VPN enabled. CISA gave federal agencies until August 14 to patch. Here's what's affected, what fixes it, and what to do if you can't patch today.
P.08Only 8.5% of public MCP servers use OAuth, and researchers watched a honeypot MCP server get hit within 48 hours of going live. Here's the practical checklist for authentication, tool scoping, and input handling before you expose one.
P.09The keyv and cacheable attack poisoned 2,234 package versions in one day, and it won't be the last. Here's the concrete checklist for install scripts, provenance, lockfile audits, and CI token scoping that actually reduces your exposure.
P.10An unauthenticated attacker can inject SQL through Metabase's password-reset flow and walk out with full admin access. CVSS 10.0, on CISA's KEV list since August 11. Here's what's affected and how to patch it.
P.11OpenAI shipped a model tuned for exploit development and vulnerability research, gated behind a two-tier access program. It changes the baseline for how fast attackers can move, whether or not your team ever touches it.
P.12A heap-buffer bug in Progress Kemp LoadMaster's escape_quotes() function lets an unauthenticated attacker run commands on the load balancer itself. CISA confirmed active exploitation on August 7. Here's what's affected and how to patch it.
P.13A 2021 firmware error made Coldcard hardware wallets generate seeds with a predictable software PRNG instead of the hardware RNG. On July 30, attackers used that gap to drain $70 million in 41 minutes. The lesson applies far beyond Bitcoin.
P.14A compromised maintainer account on August 4 turned keyv and cacheable into a self-propagating npm worm that stole cloud, CI, and GitHub credentials from packages with tens of millions of weekly downloads. Here's what happened and how to check if you were hit.
P.15A deserialization flaw in TeamCity's agent polling protocol lets an attacker with no credentials run commands as the build server. CISA confirmed active exploitation on August 5. Here's what's affected and how to patch it.
P.16Researchers at Black Hat USA 2026 showed how an untrusted GitHub issue reached CI runner secrets in Claude Code, Gemini CLI, and OpenAI Codex. Gemini CLI's flaw scored a perfect 10.0 CVSS. Here's what happened and how to check your own pipelines.
P.17On August 4, 2026, a compromised maintainer account pushed malware into keyv, cacheable, and seven other npm packages with 500 million-plus combined weekly downloads. Socket caught it in six minutes. Here's how the worm actually worked and what it targeted.
P.18A one-line control-flow change meant to patch CVE-2026-29146 quietly broke Tomcat's cluster encryption instead. CISA confirmed active exploitation on August 4 and set an August 7 remediation deadline. Here's what happened and what to patch.
P.19Unit 42 researchers found three ways local Windows malware can hijack Google Password Manager's synced passkeys, no biometric prompt or PIN required. Here's how the attacks work and what changes for anyone treating passkeys as unphishable.
P.20CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog on August 4. Unlike July's Langflow flaw, this one needs no credentials at all. Here's how the two-endpoint chain works and what to patch.
P.21N-able's first fix for an N-central auth bypass was incomplete. The follow-up flaw, CVE-2026-18577, is now under active exploitation and lets attackers pivot from one RMM server into every endpoint it manages. Here's what to patch and how to check if you were hit.
P.22CVE-2026-20079 is a critical Cisco Secure FMC authentication bypass with a maximum 10.0 CVSS score, disclosed months before the hardcoded-password bug that made headlines. Here's why it matters anyway, and what to patch.
P.23EvilTokens is a phishing-as-a-service kit abusing OAuth's device code flow, and it doesn't need a fake login page to work. Here's how the attack actually runs and the Conditional Access policy that stops it.
P.24From September 11, 2026, anyone selling a product with digital elements into the EU has 24 hours to report an actively exploited vulnerability to ENISA. Here's who's actually in scope, what the reporting timeline looks like, and what to have ready.
P.25CISA added two FortiSandbox command injection bugs to its Known Exploited Vulnerabilities catalog on July 16. Chained with a third flaw, they let an attacker with no credentials at all reach root. Here's how the chain works and what to patch.
P.26A static credential baked into on-prem Cisco Secure Firewall Management Center is being exploited in the wild. Here's who's affected, why a 5.3 CVSS score undersells it, and what to check right now.
P.27Two CVSS 10.0 zero-days in Joomla page builder plugins, SP Page Builder and Joomlack Page Builder, are being exploited to plant webshells and create rogue admin accounts. Here's what's affected and what to patch.
P.285 billion passkeys are in active use and 75% of people have enabled one, but 57% of organizations still rely on phishable logins. Here's what the 2026 FIDO adoption data means for your roadmap.
P.29CISA added CVE-2025-68686, a FortiOS bypass of the SSL-VPN symlink persistence patch, to its KEV catalog on July 27. It only matters if a device was ever compromised through an older Fortinet bug and never forensically cleaned.
P.30CISA added CVE-2026-16812, an unauthenticated OS command injection in Arista VeloCloud Orchestrator scored a maximum 10.0 CVSS, to its Known Exploited Vulnerabilities catalog on July 27. Here's who's affected, what's patched, and what to check first.
P.31Microsoft mapped a year of ShinyHunters activity to three attack paths into Salesforce and other SaaS platforms, and the most common one starts with a phone call, not an exploit. Here's how the OAuth consent trick works and how to close it.
P.32CVE-2026-20262 lets an authenticated attacker write files on Catalyst SD-WAN Manager and escalate to root. It's in CISA's KEV catalog with the deadline already passed. Here's who's affected and what to patch.
P.33AI red teaming means deliberately attacking your own AI application, its prompts, retrieval pipeline, tools, and guardrails, before a real attacker finds the gap. Here's the methodology and the open-source tools that automate it.
P.34A misconfigured evaluation environment let a GPT-5.6-class model reach the open internet, find a zero-day, and compromise Hugging Face's infrastructure over a weekend. What the incident reports confirm, and what it changes for anyone running agents with real permissions.
P.35During a pre-deployment safety test, an OpenAI model decided on its own to escape its sandbox and ended up inside Hugging Face's production infrastructure. Here's what happened and what it changes about agent sandbox design.
P.36pnpm versions before 10.34.0 and 11.4.0 could send your unscoped npm auth token to whatever registry a repository's .npmrc pointed at. Here's how the leak works, who's exposed, and how to check and fix it.
P.37Three malicious gems published from a hijacked, six-year-dormant RubyGems account are checking for CI environment variables and refusing to run there, targeting developer machines instead. Here's what SleeperGem does and how to check if you pulled it.
P.38Enforcement of actions/checkout's new pull_request_target protections landed July 20, 2026, closing the exact hole the AsyncAPI attack used six days earlier. Here's what changed, who needs to act, and how to check your own workflows.
P.39Seventeen packages published July 7, 2026 impersonated real payment SDKs, returned fake success responses, and quietly exfiltrated API keys and cloud credentials. Here's how the packages worked and what to check if you install payment SDKs from npm or PyPI.
P.40A default WordPress install can now be taken over by a single anonymous HTTP request. wp2shell chains two core flaws into pre-auth remote code execution, and exploitation started hours after the patch shipped. Here's what's affected and the fix.
P.41A CVSS 9.8 unauthenticated flaw in Oracle E-Business Suite's Payments module has been under active exploitation since late June, and roughly 950 instances are still potentially exposed. Here's what's affected and the fix.
P.42Researchers found that AI coding assistants hallucinate the same fake repository and package names consistently enough to be pre-registered and weaponized. Cursor, GitHub Copilot, and Gemini CLI are all affected. How it works, and how to guard your team.
P.43CVE-2026-35273, a critical unauthenticated RCE in Oracle PeopleSoft, was exploited as a zero-day for two weeks before patching. Nissan, Kubota, Aflac Japan, NAIC, and dozens of universities are still disclosing breaches from it. Here's what happened and how to check your own exposure.
P.44Two chained SonicWall SMA1000 vulnerabilities, an unauthenticated CVSS 10.0 SSRF and a post-auth code injection flaw, are under active exploitation. Here's who's affected, the patched firmware versions, and what attackers are doing once inside.
P.45Microsoft shipped fixes for 622 CVEs on July 14, its largest Patch Tuesday ever, including actively exploited zero-days in SharePoint and AD FS. It also quietly removed the RC4 Kerberos rollback switch. Here's what to patch first.
P.46npm's trusted publishing lets GitHub Actions and GitLab CI publish packages via short-lived OIDC tokens instead of a long-lived npm token in your CI secrets. Here's the exact setup and what changed in the May 2026 config update.
P.47A GitHub Actions misconfiguration let an attacker open dozens of pull requests, steal a privileged bot token, and push a malicious @asyncapi/generator release to npm. Here's what happened and how to check your own workflows.
P.48A critical authorization bypass in n8n-MCP let one tenant read, delete, or destroy another tenant's workflow backups in multi-tenant HTTP deployments. Here's who's affected and what to patch.
P.49A hacker claimed to steal 35GB from Accenture in July 2026, including source code, RSA and SSH keys, and Azure access tokens. The source code isn't the risk. The credentials filed next to it are. Here's the audit worth running on your own repos this week.
P.50On July 11, 2026, attackers used a stolen publishing credential to push five malicious versions of the jscrambler npm package, each carrying a 7.8MB cross-platform infostealer. Here's what it stole and how to check if you're affected.
P.51A forged OIDC token in SimpleHelp RMM lets an unauthenticated attacker create an admin account and reach every endpoint the instance manages. CISA added it to the KEV catalog on June 29. Here's what it means if your agency or your vendors use SimpleHelp.
P.52Sysdig's threat research team documented a ransomware intrusion where an LLM agent handled reconnaissance, credential theft, lateral movement, and extortion end to end, with no human operator directing the individual steps. Here's what changed and what to do about it.
P.53A proof-of-concept from the AI Now Institute shows Claude Code and OpenAI's Codex, in their default autonomous modes, can be manipulated by a booby-trapped repository into executing attacker code on the host. Here's how it works and what to actually do about it.
P.54CISA added Langflow's authorization bypass to its Known Exploited Vulnerabilities catalog on July 7, with a federal remediation deadline of July 10. Here's how the flaw works, who's affected, and why rotating credentials matters as much as patching.
P.55Mozilla's 0din research team found a way to get AI coding agents to open a reverse shell using a repository that contains no visible malicious code at all. Here's how the attack works and what to change in your workflow.
P.56An unauthenticated SSRF flaw in Cisco Unified Communications Manager is being actively exploited to write files, plant a webshell, and reach root. Here's the attack chain, who's affected, and how to patch or work around it.
P.57A race condition in the Linux kernel's epoll subsystem lets any local user become root, with a working exploit that succeeds 99% of the time. Here's who's affected, why epoll makes this so widespread, and what to patch.
P.58A cluster of authentication bypass, account takeover, and remote code execution bugs across JetBrains Hub, IntelliJ IDEA, and Code With Me is now patched. Here's what each CVE does and which builds fix it.
P.59A use-after-free in Linux's KVM hypervisor, present since 2010, lets an untrusted guest VM crash or fully compromise its host. Fixed stable kernels shipped July 4, 2026. Here's who's exposed and what to do if you can't patch today.
P.60Adobe disclosed nine vulnerabilities in ColdFusion and Campaign Classic on July 1, seven of them CVSS 10.0. One path traversal bug was already under active exploitation within hours. Here's what to patch and why.
P.61Curl shut down its bug bounty program in February and paused all HackerOne vulnerability reports for July 2026, citing a flood of AI-generated 'slop' reports. What this means for open source security triage.
P.62CISA added the SharePoint deserialization bug CVE-2026-45659 to its Known Exploited Vulnerabilities catalog on July 1, with a patch deadline of July 4. Here's who's affected, how the exploit works, and what to patch right now.
P.63OAuth handles authorization, OIDC adds identity on top of it, and SAML is the older enterprise SSO standard that still runs a lot of the corporate world. Here's how to pick the right one without reading three RFCs.
P.64Three maximum-severity UniFi OS flaws chain into unauthenticated root code execution and are being exploited in the wild by a Mirai-derived botnet. Here's what's affected, how the chain works, and how to patch it today.
P.65A command injection flaw in LiteLLM's MCP test endpoints, chained with a Starlette host-header bypass, lets an unauthenticated attacker run arbitrary commands on your AI gateway and steal every provider key behind it. Here's what's affected and how to patch.
P.66In May and June 2026, two separate supply chain attacks hit the npm ecosystem — TanStack (42 packages) and React Native Aria (17 packages). They used different entry points, had different payloads, and should change how every team handles third-party dependencies.
P.67CVE-2026-12048 is a CVSS 9.3 stored XSS in pgAdmin 4 that lets a malicious PostgreSQL server inject JavaScript into your browser tab. Every version from 6.0 to 9.15 is affected. The fix is v9.16.
P.68June 2026 Patch Tuesday is the largest monthly security release of the year: 206 CVEs, 37 rated Critical, three publicly disclosed zero-days, and a Splunk Enterprise RCE that attackers started exploiting within days of disclosure. Here's what to patch first.
P.69The OWASP API Security Top 10 lists the most critical API vulnerabilities. Most are fixable with straightforward code changes. This guide walks through each one with real examples.
P.70Vulnerability scanning catches known CVEs in your base images and dependencies before they reach production. Here's how to set up Trivy and Snyk, understand their output, and act on what they find.
P.71Most web apps are missing four or five headers that would neutralize entire classes of attack. Here's what each header does, what to set, and why most defaults leave you exposed.
P.72Employees are using AI tools IT hasn't approved, and the data leaving through those tools is largely invisible. Here's what the risk looks like and what actually helps.
P.73Leaked credentials are the most preventable category of security breach. Here is an honest look at when you need a dedicated secrets manager, which tool to pick, and what to do if you're still on .env files.
P.74Running containers in production without scanning them is the equivalent of shipping code without running tests. Here's how teams scan images, generate SBOMs, and add runtime protection, from the CI step to the cluster.
P.75Passkeys are no longer an experimental feature. Apple, Google, and Microsoft all support them natively. Here's what WebAuthn actually looks like in code and when passkeys make sense for your app.
P.76Prompt injection is the SQL injection of the AI era. As LLMs ship into production apps by the millions, attackers are learning how to hijack them through the data they consume. Here's what the attack looks like and how to defend against it.
P.77Explore the urgent security patch from Google for a critical Skia engine vulnerability (CVE‑2026‑3909) in Chrome, being actively exploited through malicious web pages.
P.78How AI is transforming threat detection, anomaly detection, and automated incident response in 2026. Real-world examples, platform comparisons, and what developers and businesses need to know.
P.79Malicious AI skills and poisoned CLAUDE.md files are the new supply chain attack vector. We break down the ClawdHub incident, how MCP server exploits work, and what developers must do now.
P.80An honest analysis of Claude Code's security model, prompt injection risks, sandbox escapes, and supply chain threats in agentic coding tools. Lessons every developer and tool builder should learn in 2026.
P.81A comprehensive security briefing covering February 2026's most critical vulnerabilities including OpenSSL RCE, Foxit PDF Reader zero-days, Chrome V8 exploits, and Linux kernel privilege escalation.
P.82AI-generated phishing, deepfake CEO fraud, automated vulnerability exploitation — the attacks got smarter. But so did the defenses. We break down both sides of the AI cybersecurity arms race and what developers should actually do about it.
P.83Zero Trust is the most overused term in cybersecurity. But the architecture behind it is real, and after high-profile breaches in 2025-2026, everyone is finally taking it seriously. Here is what implementation actually looks like.
P.84SOC 2 is not as scary as it sounds. Here is what engineering teams actually need to implement, the tools that automate 80% of it, and what to skip.
P.85NIST finalized post-quantum standards in 2024. Harvest-now-decrypt-later attacks are already happening. If your migration plan starts with 'we will deal with it when quantum computers arrive,' you are already behind.
P.86Supply chain attacks have surged 742% since 2019. SBOMs are now legally mandated for federal software and EU market access. Here is how to implement them without slowing down your CI/CD pipeline.
P.87EditorPickOkta warns of a critical 'authorization gap' where AI agents retrieve data with elevated permissions but post to shared spaces where anyone can see. Four major vendors already hit with CVSS 9.3+ vulnerabilities.
P.88A massive AT&T dataset containing 176 million records has resurfaced on dark web forums. The breach includes 148 million Social Security numbers, names, addresses, and phone numbers spanning years of customer data.