Blog

The Dangers of Reusing Protobuf Definitions: Critical Code Execution in protobuf.js (GHSA-xq3m-2v4x-88gg)

It's About Thyme: How a Whitespace Character Broke Thymeleaf's Expression Sandbox (CVE-2026-40478)

AI coding agents can write working code, but mostly not secure code. Explore benchmark results showing over 80% of AI-generated code contains vulnerabilities.

Blockchain-based C2 lets attackers run malware infrastructure that can’t be taken down. Learn how it works, why it’s spreading, and what defenders can still do.

SAST tools scan source code for security vulnerabilities without running the application. Compare the top 10 tools by accuracy, speed, and noise reduction.

WebSocket pre-auth RCE, confirmed exploited in the wild within 10 hours of disclosure. Tens to hundreds of instances may remain exposed. Upgrade to 0.23.0.

What do security practitioners and software engineers actually fear about open source malware? We asked 605 professionals. Here is what 141 of them said, in their own words.

Gen AI AppSec tools compared for 2026. Seven platforms evaluated on noise reduction, reachability analysis, AI-specific threat detection, and developer fit.

Best DevSecOps tools for 2026: seven platforms compared on false positive rates, reachability analysis, and actionable remediation guidance for AppSec teams.

Best AST tools compared on false positive rates, reachability depth, and workflow integration. See how 7 platforms reduce real security risk for dev teams.

DevSecOps platforms compared: 10 tools tested with real codebases for alert noise reduction, reachability analysis, and CI/CD integration for AppSec teams.

AppSec tools for 2026 ranked by noise reduction, false positive rates, and workflow integration. 10 platforms compared across SAST, SCA, DAST, and ASPM.

Best code security platforms compared: 8 tools rated on reachability analysis, false positive rates, and workflow integration so you fix real risks, not noise.

New Endor Labs research reveals 92% of npm account takeovers occurred in 2025, targeting packages with millions of downloads

TeamPCP Strikes Again: Telnyx Compromised

Best SCA tools for 2026 compared on reachability analysis, false positive rates, and remediation quality. 10 leading platforms reviewed with hands-on testing.

Lessons in Hardening GitHub Actions

AI has collapsed the cost of offense to pocket change.

Software supply chain security tools detect and fix vulnerabilities in your dependencies. Compare 7 top platforms on reachability analysis and noise reduction.

Supply chain management in software companies protects code, dependencies, and build processes. Compare 5 security approaches that reduce alert noise by 95%.

Malware package firewalls block malicious open source code before installation. Compare 5 leading tools by detection accuracy, coverage, and developer fit.

Best SAST tools for 2026 compared by detection accuracy, false positive rates, and scan speed. Choose the right scanner for your tech stack and CI/CD workflow.

Supply Chain Attack on popular PyPI library LiteLLM