Insights, tutorials, and best practices for secure development
In December 2025, BeyondTrust Phantom Labs reported a textbook OS command injection in OpenAI Codex. The injection vector was a git branch name. The payoff was a GitHub User Access Token with read and write across the user's repos. The patch covered every Codex surface — ChatGPT web, CLI, SDK, and IDE Extension. CWE-78, in a chatbot wrapper.
Vercel got breached in April 2026 through a compromised third-party AI tool used by one employee. The reported chain runs back through several hops to a Roblox cheat download. Here is what happened and what it means for everyone who treats vendor AI tooling as out-of-scope.
On March 19, 2026, a threat actor called TeamPCP turned Trivy — the most widely deployed open-source vulnerability scanner — into a credential-theft tool running inside thousands of CI pipelines. Here is what happened and what it changes for anyone who runs scanners in CI.
A malicious PyPI package marketed as a Tor-routed AI privacy proxy was exfiltrating prompts in plaintext — and shipped a 246,000-character copy of Anthropic's Claude Code system prompt, incompletely rebranded as "AXIOM-1." Here's what it tells us about supply chain trust and system prompt forensics.
A self-propagating npm worm plants malicious MCP servers into Claude Code, Cursor, and Windsurf configurations — then uses prompt injection to instruct your AI assistant to collect SSH keys, cloud credentials, and API tokens. Here's how it works and what it means for agentic development security.
Someone bought 31 WordPress plugins on Flippa, waited eight months, then activated a blockchain-controlled backdoor. WordPress.org has no mechanism to flag ownership changes. Here's how the attack worked and why the structural vulnerability remains.
GDPR security requirements under Articles 25 and 32 mandate technical data protection measures. Learn what developers must implement to comply.
Continuous compliance automation replaces manual audit prep with automated evidence collection, scan-to-control mapping, and real-time dashboards.
HIPAA security scanning maps technical safeguards to SAST, SCA, and DAST tools. Automate ePHI risk analysis and produce audit-ready evidence.
PCI DSS vulnerability scanning maps key requirements to scanning tools. Learn quarterly ASV scans vs. continuous scanning and what auditors expect.
A threat group compromised Trivy, used it to steal LiteLLM's PyPI credentials, and published poisoned packages that led to a 4TB data breach at Mercor. Here's how the cascading supply chain attack worked and what it means for AI infrastructure security.
A security headers check reveals if your HTTP headers defend against clickjacking, XSS, and MIME sniffing. Learn to configure every critical header.
Showing 13–24 of 199 posts