One Brotli decoder bug. A lot of copies. TL;DR - CVE-2026-111497 is an out-of-bounds write in the Brotli decompressor in google/brotli, fixed upstream in 1.2.1. It is not a separate Node, PHP, or npm ...
AI agents are writing code now. That part is settled. The question security teams should be asking is: how do you make those agents write secure code from the start, rather than trying to catch ...
Are you ready to take your coding skills to the next level and ensure that your code is safe and secure on the internet? This exclusive training led by renowned security expert Tanya Janca will cover ...
We want using Semgrep to be like hiring an AppSec engineer to do the boring work. To be the best platform for code scanning, Semgrep must go beyond finding issues. It must autonomously remove noise, ...
It's been a busy week for supply chain incidents. Yesterday the PHP Foundation disclosed PHP2Shell, a vulnerability that has existed in PHP for over a decade. We broke down how that worked in our post ...
In the first part of this series, I argued that after 22 years, it's time to replace Cybersecurity Awareness Month with Cybersecurity Readiness Month. Awareness made sense in 2004, but today everybody ...
You can do everything right and still get compromised. Part four of the Cybersecurity Readiness Month series covers how to contain an attacker, respond fast, and recover cleanly once they’re in. For ...
TL;DR I lay out a case for moving security enforcement into the hands of developers. I show how I and another developer at r2c successfully identified data leakage in our logs, fixed the issue, and ...
Finding vulnerabilities is not the problem anymore. Every code scan, pipeline, and dashboard produces more results than security teams can manage. The real challenge is knowing which vulnerabilities ...
AI coding agents are helping developers ship faster than ever, but they’re also creating a new security challenge: more code is being generated before traditional security tools have a chance to catch ...
This post describes the thought process behind writing a new Semgrep rule and gives a methodology for doing so effectively. There’s no one right way or process for writing a Semgrep rule. Do what ...
Results that may be inaccessible to you are currently showing.
Hide inaccessible results