7 articles tagged
CVE-2026-9198 chains two Langflow API endpoints into unauthenticated remote code execution on default deployments. IBM rates it CVSS 9.8, CISA calls it exploited, and the fix is a version bump plus three configuration
The Node.js permission model gained --allow-net in v25 (October 2025). This guide shows how to scope file, network and process access in production, using the 2026 npm supply-chain attacks as motivation.
Browser tools for GitHub Copilot in VS Code became generally available on 1 July 2026 and ship enabled by default. These are the settings, policies and rollout order that keep agent browsing contained.
Four of the 13 Next.js advisories published in May 2026 let attackers reach protected pages without passing middleware. Patching to 16.2.5 does not close all of them, and the reason is Turbopack.
AI writes a growing share of enterprise code, and 2026 attacks like GhostApproval and Friendly Fire target the assistants themselves. A senior engineer's guide to the AppSec layer AI-assisted teams need, and how eCorpIT
The Cloud Security Alliance documented 74 AI-linked CVEs through March 2026, a 406 million record exposure from one default Firebase rule, and hardcoded secrets in 72% of AI-enabled Android apps. Here is what to fix
Eleven CVEs landed against Model Context Protocol implementations in April 2026, and Anthropic called the underlying STDIO behaviour expected. Here is what that means for anyone running MCP servers in production
