Docker Hub Access Token Vulnerability: A Two-Year Silent Transfer
A Docker Hub access token vulnerability let account conversion hand live PATs to another user for two years. What Docker found and changed, and what to check.
Datadog Retired Its Host Scanner: 4 Lessons From the Migration
Datadog swapped its SSH host scanner for the Datadog Agent after a six-month parallel run. Its vulnerability management lessons apply to any scanner swap.
The First 72 Hours of Ransomware: Why 'Restored Isn't Recovered' Changes Your Incident Response Plan
Restoring systems isn't recovering the business. Ransomware's first 72 hours need data validation, dependency checks, and SIEM mapped to MITRE ATT&CK.
JFrog: AI Coding Tools Are Generating Vulnerabilities 10 Times Faster Than They're Being Fixed
JFrog's 2026 report: AI coding tools add about 35 CVEs a month as disclosures rose 92% in 2025, and CISA now advises against severity-only vulnerability triage.
Datadog Workload Protection Can Now Kill Processes and Isolate Workloads Mid-Attack
Datadog's Workload Protection has added automated and manual response actions — kill offending processes and isolate compromised containers — closing the gap between detection and remediation without a human handoff.
Agent Immunization: The Software Supply Chain Security Model Built for AI Speed
JFrog's agent immunization framework embeds trust enforcement inside what AI agents consume—not at the perimeter—because perimeter security cannot keep pace with agentic development velocity.
Datadog Risk AI: How Systemic Risk Detection Moves Beyond Individual Findings
Datadog's Risk Engineering team built an AI agent layer that correlates security signals across vulnerability, identity, and exposure dimensions — recognizing that severity and risk aren't the same thing.
AI Just Found a 27-Year-Old Vulnerability. Your AppSec Stack Wasn't Built for This Speed.
Claude Mythos Preview independently found and weaponized a 27-year-old OpenBSD flaw, a 16-year-old FFmpeg bug, and a 17-year-old FreeBSD RCE. JFrog's analysis explains why fragmented security tooling can't keep up.
Unfixed Kubernetes CVEs: What You Can and Can't Actually Detect
Four Kubernetes CVEs have been unfixed since 2020–2021 — not because they were overlooked, but because patching would break the platform. Here's how to know if your cluster is actually exposed.
Understanding Unfixed Kubernetes CVEs: What You Can — and Can't — Detect
Four Kubernetes CVEs remain unfixed because patching would break the platform. Datadog's guide to audit-log-based detection shows what each one exposes — and the honest limits of what audit logs can confirm.
An OpenAI Model Found a Zero-Day in Artifactory. JFrog Patched It Fast.
OpenAI's models autonomously chained vulnerabilities to escape a sandbox and reach Artifactory infrastructure — a preview of what 'AI as attacker' means for patch response times.
NuGet Typosquat: How One Extra Letter Rigged a Betting Platform's Odds
JFrog uncovered Newtonsoftt.Json.Net, a typosquatted NuGet package that patched a betting platform's game logic to rig crash-game outcomes on a schedule only the attacker knew.
CVE Severity Scores Are Inflated: JFrog's 96% Finding
JFrog's security team found 96% of critical CVEs warranted a lower rating. Their prototype pollution research exposes why CVSS scores routinely misrepresent real-world exploitability.
Checkmarx's New SAST Engine Isn't About the LLM. It's About What Comes After.
Checkmarx unveiled a hybrid SAST engine with three components — a deterministic scanner, an LLM trained on security data, and a Finding Analysis Engine that filters false positives before results reach developers. The differentiator is the last one.
PixelSmash: The FFmpeg Heap Overflow That Turns Media Files Into Attack Vectors
CVE-2026-8461 is a CVSS 8.8 heap out-of-bounds write in FFmpeg's MagicYUV decoder — enabled by default, triggerable without user interaction, and already demonstrated as RCE against Jellyfin and Nextcloud.
npm v12's Biggest Security Change: Installation Scripts Now Need Your Permission
npm v12 disables lifecycle scripts, Git dependencies, and remote URL resolution by default — an explicit trust model that blocks 53% of malicious npm attacks and requires teams to audit their CI/CD pipelines before upgrading.
JFrog Brings Xray Security Data Into Amazon Kiro With a New Open-Source Power
JFrog Power for Kiro adds artifact search, repository management, and live CVE data from JFrog Xray directly into Kiro's MCP-native IDE — closing the gap between AI-assisted coding and security validation.
Snyk Evo: Continuous Pentesting to Match the Pace of AI Code
Traditional pentesting averages 15 days of coverage per year. Snyk Evo runs AI agents against your application stack continuously. Here's the architecture and the gap it closes.
HashiCorp Vault Radar: Why Finding Secrets Isn't Enough
HashiCorp's Vault Radar reframes secret detection as a remediation problem. Four pillars that shift the security metric from secrets found to secrets resolved per week.
Ingress NGINX Is EOL: What the K8s Gateway API Migration Actually Requires
Ingress NGINX reached end-of-life in March 2026 with unpatched critical CVEs. Kubernetes Gateway API is the designated successor — here's what the migration breaks and what Datadog maps out.
LiteLLM Compromised: How the AI Gateway Became the Attack Surface
On March 24, attackers compromised LiteLLM via a single unpinned CI dependency, deploying credential harvesters and Kubernetes backdoors across affected environments.
Datadog Bits AI Dev Agent: Automated Vulnerability Remediation at Scale
Datadog's Bits AI Dev Agent opens GitHub PRs to fix SAST findings automatically — closing the security backlog that manual triage alone can't clear.