Insights, tutorials, and best practices for secure development
Compare the top vulnerability scanning tools for 2026. See how Snyk, SonarQube, Semgrep, CodeQL, GitHub Advanced Security, and Rafter stack up on accuracy, speed, language support, and pricing.
On April 26, 2026, Robinhood's own mail infrastructure sent phishing emails to its own users. SPF, DKIM, and DMARC all passed. The malicious HTML and phishing URL were interpolated into the email body by an unsanitized device-name field during the attacker's signup flow. Humans noticed on a careful read. Inbox-reading AI agents — built to trust the signed channel and act on what's inside — won't.
In December 2025, BeyondTrust Phantom Labs reported a textbook OS command injection in OpenAI Codex. The injection vector was a git branch name. The payoff was a GitHub User Access Token with read and write across the user's repos. The patch covered every Codex surface — ChatGPT web, CLI, SDK, and IDE Extension. CWE-78, in a chatbot wrapper.
Vercel got breached in April 2026 through a compromised third-party AI tool used by one employee. The reported chain runs back through several hops to a Roblox cheat download. Here is what happened and what it means for everyone who treats vendor AI tooling as out-of-scope.
On March 19, 2026, a threat actor called TeamPCP turned Trivy — the most widely deployed open-source vulnerability scanner — into a credential-theft tool running inside thousands of CI pipelines. Here is what happened and what it changes for anyone who runs scanners in CI.
A malicious PyPI package marketed as a Tor-routed AI privacy proxy was exfiltrating prompts in plaintext — and shipped a 246,000-character copy of Anthropic's Claude Code system prompt, incompletely rebranded as "AXIOM-1." Here's what it tells us about supply chain trust and system prompt forensics.
A self-propagating npm worm plants malicious MCP servers into Claude Code, Cursor, and Windsurf configurations — then uses prompt injection to instruct your AI assistant to collect SSH keys, cloud credentials, and API tokens. Here's how it works and what it means for agentic development security.
Someone bought 31 WordPress plugins on Flippa, waited eight months, then activated a blockchain-controlled backdoor. WordPress.org has no mechanism to flag ownership changes. Here's how the attack worked and why the structural vulnerability remains.
GDPR security requirements under Articles 25 and 32 mandate technical data protection measures. Learn what developers must implement to comply.
Continuous compliance automation replaces manual audit prep with automated evidence collection, scan-to-control mapping, and real-time dashboards.
HIPAA security scanning maps technical safeguards to SAST, SCA, and DAST tools. Automate ePHI risk analysis and produce audit-ready evidence.
PCI DSS vulnerability scanning maps key requirements to scanning tools. Learn quarterly ASV scans vs. continuous scanning and what auditors expect.
Showing 25–36 of 213 posts