11 articles tagged
OpenAI's Codex Security CLI is Apache-2.0 open source, but it calls a gated, metered engine. How to install it, wire it into CI with exit codes and SARIF, and where it fits next to Semgrep, CodeQL and Snyk.
On 28 July 2026 GitHub began ingesting OpenSSF malicious-packages advisories, so Dependabot malware alerts now cover npm, PyPI and more. Here is how to enable them and respond when one fires.
GitHub shipped a CodeQL query on 10 July 2026 that catches prompt injection in code review: js/system-prompt-injection flags untrusted input flowing into an AI model's system prompt. Here is what it detects, how to turn
The first scheduled Next.js security release landed on 20 July 2026 with nine CVEs across App Router, Server Actions, rewrites and the image endpoint. Here is who is actually exposed and how to patch.
Four of the 13 Next.js advisories published in May 2026 let attackers reach protected pages without passing middleware. Patching to 16.2.5 does not close all of them, and the reason is Turbopack.
AI writes a growing share of enterprise code, and 2026 attacks like GhostApproval and Friendly Fire target the assistants themselves. A senior engineer's guide to the AppSec layer AI-assisted teams need, and how eCorpIT
Slopsquatting turns AI package hallucinations into supply-chain attacks. A practical guide to the data, the confirmed incidents, and seven CI controls that block hallucinated dependencies before they reach production
Adversa AI tested 11 open-source coding agents in June 2026 and beat the safety filter on 10 of them with shell tricks that are 30 years old. How the bypass works, which designs held, what to change now.
Eleven CVEs landed against Model Context Protocol implementations in April 2026, and Anthropic called the underlying STDIO behaviour expected. Here is what that means for anyone running MCP servers in production
Microsoft's July 2026 Patch Tuesday fixed a record 570 flaws, including two zero-days already under attack. AI-assisted discovery is why the number exploded, and why the old triage signals stopped working.
CVE-2025-3248 gave unauthenticated attackers code execution on Langflow, and it was not the last. How to harden Langflow, Flowise, and n8n: patching, network isolation, gateway auth, secrets, and sandboxing for AI
