Programming
Software development: programming languages, coding, libraries and frameworks, software engineering and architecture, source control, developer tools, databases, and infrastructure.
-
Orca orca.security
State of Cloud Security Report (2025) - Analyzes security challenges in multi-cloud environments, with a focus on AI risk, data exposure, and neglected assets. Key findings reveal that 62% of organizations have at least one vulnerable AI package, 38% expose sensitive databases…
-
The Open Source Security Foundation (OpenSSF) openssf.org
A cross-industry collaboration to improve the security of open source software.
-
BlackDuck news.blackduck.com
BSIMM16 (2026) - Analyzes the maturity and evolution of software security initiatives across diverse industry verticals by documenting observed development practices. Studies conducted on 111 participating organizations reveal that successful programs prioritize scaling…
-
Legit Security legitsecurity.com
State of Application Risk Report (2025) - Examines the current state of application risk in 2025, focusing on common vulnerabilities and security testing inefficiencies. Key findings reveal significant issues with secrets exposure, AI-related risks, and software supply chain…
-
Kong konghq.com
API Security Perspectives (2025) - While 55% of organizations experienced an API security incident in the past year, 85% say they’re confident in their organization’s security capabilities. This confidence may be misplaced, given 77% acknowledge the potential for significant…
-
Imperva imperva.com
API Security Threat Report (2026) - Examines API security threats and token handling risks across 32,725 endpoints and 1,104 customer accounts. Key findings reveal that nearly 40% of endpoints carry multiple authentication risks simultaneously, with sensitive data appearing in…
-
Iconiq iconiq.com
State of AI Bi Annual Snapshot (2026) - Examines the evolving architecture and monetization strategies of artificial intelligence products within enterprise software companies. Key findings reveal that 69% of builders now focus on vertical applications, while teams leverage an…
-
IBM ibm.com
X Force Threat Intelligence Index (2026) - Investigates the evolving threat landscape of 2025 by analyzing incident response data and vulnerability trends across global software and cloud ecosystems. Key findings reveal a 44 percent increase in the exploitation of public-facing…
-
Houlihanlokey hl.com
How AI Is Reshaping Digital Engineering (2025) - Examines the transformative impact of artificial intelligence on digital engineering, highlighting the shift toward agentic systems and consulting-led delivery models. Key findings indicate that the market for artificial…
-
HardenStance hardenstance.com
Telco Strategies for Consumer Security (2026) - Investigates global telecommunication operator strategies and investments in consumer cybersecurity software. Key findings indicate that global spending reached $441 million in 2025, which amounts to less than 0.1% of the $442…
-
Guy Carpenter guidewire.com
US Cyber Industry Exposure Database (2025) - Analyzes the US cyber industry exposure and loss curve for 2025, detailing market conditions and providing benchmarks for risk transfer. Key findings indicate a heightened risk landscape due to deregulation and nation-state activity…
-
GSMA gsma.com
Security Landscape (2026) - Analyzes the evolving mobile telecommunications security landscape, focusing on critical threats such as software vulnerabilities, supply chain compromises, and the democratization of attack tools. Key findings highlight that the global scam economy…
-
Git Guardian gitguardian.com
State of Secrets Sprawl (2026) - Examines the state of secrets sprawl and security vulnerabilities, detailing the impact of rapid development cycles and AI adoption. Key findings reveal 28.65 million new hardcoded secrets in public GitHub commits during 2025, representing a 34…
-
Fortinet fortinet.com
Web Application Security Report (2026) - Examines the security posture of web applications and APIs in the context of artificial intelligence adoption, highlighting a widening readiness gap between modernization and operational control. Key findings reveal that 74% of…
-
Fluid Attacks fluidattacks.com
State Of Attacks (2026) - Analyzes the state of cybersecurity and vulnerability management across diverse software development environments, documenting trends in risk exposure and remediation efficiency throughout 2025. Key findings reveal that while the vulnerability…
-
FINOS finos.org
State of Open Source in_Financial Services (2025) - Analyzes the current state of open source software adoption and strategic maturity within the global financial services sector. Key findings indicate that 87 percent of organizations now view open source as critical to their…
-
F5 f5.com
Advanced Persistent Bots Report (2025) - Examines the behavior of advanced persistent bots across 200 billion transactions, assessing the impact of mitigation on web and mobile API platforms. Analysis reveals that while overall automated attacks declined in most sectors, the…
-
F5 f5.com
Office of the CTO Report Continuous API Sprawl (2026) - Examines the rapid expansion and economic impact of application programming interfaces across modern enterprise environments, detailing the primary factors driving continuous digital sprawl. Key findings reveal that the…
-
Millions of Secrets Exposed via Web Application Frontends web.archive.org
Millions of secrets exposed in web app frontends via JavaScript and debug pages.
-
Can you trust ChatGPT's package recommendations? vulcan.io
Exploit generative AI platforms' tendency to generate non-existent coding libraries to execute Dependecy Confusion.
-
#redteam tip: want to discretely extract credentials from a CI/CD pipeline? twitter.com
Draft pull requests won't alert repository contributors, but will still trigger pipelines.
-
(The) Postman Carries Lots of Secrets trufflesecurity.com
Postman's public API network leaks thousands of secrets due to confusing UI, forks, and insufficient secret scanning.
-
Sourcegraph sourcegraph.com
A web-based code search and navigation tool for public repositories.
-
Deep dive into Visual Studio Code extension security vulnerabilities snyk.io
VS Code extensions have vulnerabilities (command injection, path traversal, zip slip) that can compromise developer machines.
-
Edgescan edgescan.com
Vulnerability Statistics Report (2026) - Analyzes the state of full stack security by evaluating millions of assets across diverse industries to identify critical vulnerabilities and remediation trends. Key findings reveal that 31.9 percent of discovered web application and API…
-
Risk Explorer for Software Supply Chains riskexplorer.endorlabs.com
-
-
Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows paloaltonetworks.com
GitHub Actions, even when pinned to a commit SHA, can still pull in malicious code via mutable dependencies like Docker images, unlocked packages, or external scripts.
-
All the Small Things: Azure CLI Leakage and Problematic Usage Patterns paloaltonetworks.com
Azure CLI leaks secrets to CI/CD logs due to usage patterns.
-
Abusing Repository Webhooks to Access Internal CI/CD Systems at Scale paloaltonetworks.com
Repository webhooks, used to trigger CI/CD pipelines, can be abused to access internal systems.
-
How I hacked into Google's internal corporate assets observationsinsecurity.com
More ways to find dependencies in code for Dependency Confusion.
-
Hidden GitHub Commits and How to Reveal Them neodyme.io
A tool that can reveal deleted GitHub commits that potentially contain sensitive information and are not accessible via the public Git history.
-
10 real-world stories of how we've compromised CI/CD pipelines nccgroup.com
Examples include exploiting S3 misconfigurations, Jenkins plugin flaws, GitLab runner privilege escalations, Kubernetes pod annotation vulnerabilities, and compromised developer laptops.
-
PPE — Poisoned Pipeline Execution medium.com
Poisoned Pipeline Execution (PPE) lets attackers run malicious code in a CI/CD system without direct access.
-
Vulnerable GitHub Actions Workflows Part 1: Privilege Escalation Inside Your CI/CD Pipeline legitsecurity.com
GitHub Actions workflow_run PE.
-
How We Hacked a Software Supply Chain for $50K landh.tech
Scraped JavaScript front-end files of the target and used ASTs to identify import/require statements which lead to discovering a public container with NPM credentials.
-
How a Single Vulnerability Can Bring Down the JavaScript Ecosystem landh.tech
Cache poisoning attack on the NPM registry rendering packages unavailable.
-
Fixing typos and breaching microsoft's perimeter johnstawinski.com
Bypass GitHub workflow approval requirement by becoming a contributor.
-
Forging signed commits on GitHub iter.ca
A bug in GitHub's API allowed forging signed commits. By exploiting a regex flaw in an internal Codespaces API endpoint, an attacker could create commits signed by any user, despite GitHub's web flow signature.
-
Data Dog datadoghq.com
State Of DevSecOps (2026) - Analyzes the current state of DevSecOps by investigating the prevalence of exploitable vulnerabilities and the risks associated with rapid software dependency updates. Findings indicate that 87 percent of organizations maintain at least one…
-
Darktrace darktrace.com
Annual Threat Report (2026) - Analyzes the global cyber threat landscape through behavioral analysis and real world customer data from across international regions. Key findings reveal that software as a service and email based social engineering account for nearly 70% of all…
-
GHTorrent Project ghtorrent-downloads.ewi.tudelft.nl
A queryable offline mirror of the GitHub API data. Tutorial.
-
Dependency Confusions in Docker and remote pwning of your infra errno.fr
Docker dependency confusion occurs when a misconfigured Docker mirror pulls malicious public images instead of private ones.
-
How We Discovered Vulnerabilities in CI/CD Pipelines of Popular Open-Source Projects cycode.com
Extracting all repository and organization secrets in GitHub Actions.
-
Holes in Your Bitbucket: Why Your CI/CD Pipeline Is Leaking Secrets cloud.google.com
Bitbucket Secured Variables leak secrets via artifact objects; recommendations include using dedicated secrets managers and code scanning.
-
Cycode cycode.com
State Of Product Security (2026) - Examines the current state of product security in the era of artificial intelligence, focusing on the rapid adoption of coding assistants and the resulting expansion of the organizational attack surface. Research indicates that while 97…
-
StarJacking – Making Your New Open Source Package Popular in a Snap checkmarx.com
StarJacking is a technique where attackers make malicious open-source packages appear popular.
-
What the fork? Imposter commits in GitHub Actions and CI/CD chainguard.dev
GitHub Actions vulnerability allows forked commits to bypass workflow security settings.
-
Thousands of images on Docker Hub leak auth secrets, private keys bleepingcomputer.com
Researchers found thousands of Docker Hub images leaking private keys and API secrets.
-
Can You Trust Your VSCode Extensions? aquasec.com
Impersonate popular VSCode extensions and trick unknowing developers into downloading them.
- next page of items loading…
