Semgrep Guardian goes self-serve with Codex support, plus incident-first advisories and transitive Autofix. See everything ...

One Brotli decoder bug. A lot of copies. TL;DR - CVE-2026-111497 is an out-of-bounds write in the Brotli decompressor in google/brotli, fixed upstream in 1.2.1. It is not a separate Node, PHP, or npm ...

You can do everything right and still get compromised. Part four of the Cybersecurity Readiness Month series covers how to contain an attacker, respond fast, and recover cleanly once they’re in. For ...

AI coding agents are helping developers ship faster than ever, but they’re also creating a new security challenge: more code is being generated before traditional security tools have a chance to catch ...

In the first part of this series, I argued that after 22 years, it's time to replace Cybersecurity Awareness Month with Cybersecurity Readiness Month. Awareness made sense in 2004, but today everybody ...

Semgrep is proud to sponsor the NexGen Agentic AI Infrastructure, Observability & Security Summit in New York City. Our team will be on site, so stop by our table to pick up some swag, meet the team, ...

Semgrep is now part of Cursor Origin - bringing automated security scanning directly to repositories hosted in Cursor. If ...

In the first part of this series, I argued that after more than two decades, we should retire Cybersecurity Awareness Month and replace it with Cybersecurity Readiness Month. Awareness was a ...

A contact who runs an engineering org at a growing startup told a story on LinkedIn recently that raises a shared experience among many engineering leaders. His team had mostly standardized on an AI ...