|
You Can Be Aware and Still Get Compromised. Readiness Limits the Damage.
|
Cris Thomas (Space Rogue) |
2026-10-27 |
1,300 |
--
|
|
Broccoli2Shell: The One Decoder to Rule Them All
|
Lewis Ardern, Diptendu Kar |
2026-10-27 |
1,396 |
1
|
|
Patch Your Node and Eat Your Brotli Or You Won’t Get Dessert
|
Diptendu Kar, Kurt Boberg |
2026-10-22 |
991 |
--
|
|
Your Security Tools Won't Save You. Is Your Organization Actually Ready?
|
Cris Thomas (Space Rogue) |
2026-10-21 |
1,098 |
--
|
|
If you run Apache with mod_php, stop reading and patch now: upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
|
Kurt Boberg |
2026-10-21 |
902 |
--
|
|
Introducing Semgrep in Cursor Origin
|
Gabriel Lopes |
2026-10-14 |
354 |
--
|
|
Cybersecurity Awareness Won’t Save You. Readiness Might.
|
Cris Thomas (Space Rogue) |
2026-10-12 |
1,402 |
--
|
|
The End Is Nigh for Code Review
|
Daghan Altas |
2026-10-09 |
1,718 |
--
|
|
"I wanted the big name on my resume": Why our former interns chose a startup anyway
|
Margaret Briseño |
2026-10-08 |
1,551 |
--
|
|
Why Engineers Are Switching to Codex
|
Jayson DeLancey |
2026-10-06 |
1,101 |
--
|
|
MCP Gives Agents Tools. Hooks Give Security Control.
|
Cris Thomas (Space Rogue) |
2026-10-05 |
1,227 |
--
|
|
It’s Time to Rename Cybersecurity Awareness Month
|
Cris Thomas (Space Rogue) |
2026-10-02 |
1,316 |
1
|
|
Claude Opus 5.5 Writes Working Code but Only Half of It Is Secure
|
Katie Paxton-Fear |
2026-09-29 |
2,310 |
--
|
|
What Application Security Actually Does All Day
|
Katie Paxton-Fear |
2026-09-25 |
1,996 |
--
|
|
Introducing Malware Detection and Response Automation
|
Nabeel Saeed |
2026-09-24 |
795 |
--
|
|
The AI Ecosystem Has Worms Now: Inside the MemTensor Compromise
|
Katie Paxton-Fear |
2026-09-23 |
1,308 |
--
|
|
Meet the Semgrep Interns: Four Projects from Summer 2026
|
Amarin Phaosawasdi |
2026-09-11 |
1,349 |
--
|
|
Shift Right? After 20 Years of Shift Left?
|
Cris Thomas (Space Rogue) |
2026-09-04 |
1,580 |
--
|
|
Feeling the heat from Malicious Packages? Cool off with Cooldowns
|
Leif Dreizler |
2026-08-31 |
2,481 |
--
|
|
Semgrep Multimodal Goes Beyond Authentication: What we learned from Comparing it with Mythos
|
Brenden Noblitt, Jaweed Metz, Seth Jaksik |
2026-08-27 |
1,907 |
--
|
|
We benchmarked A LOT of models, here’s how they compare to Mythos
|
Isaac Evans, Katie Paxton-Fear, Brenden Noblitt, Seth Jaksik |
2026-08-25 |
1,612 |
--
|
|
Hacker Summer Camp 2026: A Longitudinal Study of 2,295 Talks
|
Jayson DeLancey, Carlie Marvel |
2026-08-21 |
3,696 |
--
|
|
Rust crates arrayref & append-only-vec compromised via malicious proc-macro1 dependency
|
Diptendu Kar |
2026-08-20 |
260 |
--
|
|
GLM-5.3 delivers Opus 4.8-level cybersecurity results at a fraction of the cost
|
Pablo Estrada, Erik Buchanan, Seth Jaksik, Brenden Noblitt |
2026-08-14 |
823 |
--
|
|
Speedrunrunning SHA pinning for GitHub Actions org-wide
|
Leif Dreizler |
2026-08-12 |
3,727 |
8
|
|
What Happens to Your AppSec Program When Going from Zero to 60k Lines of Code a Day
|
Jayson DeLancey |
2026-08-04 |
1,606 |
--
|
|
It’s not npm-ver yet: NPM worm Chaindrop hits 400+ packages including jaredwray, servicetitan, ornikar, qlik and nebula.js
|
Katie Paxton-Fear |
2026-08-04 |
2,822 |
--
|
|
Crypto is Fine. The Code is Not.
|
Diptendu Kar |
2026-07-30 |
939 |
--
|
|
Introducing Semgrep Agentic Workflows: Automate Deep Vulnerability Hunting at Scale
|
Pablo Estrada |
2026-07-28 |
773 |
--
|
|
Kimi K3's Code Security Results Look Competitive - Until You Look at Precision
|
Katie Paxton-Fear, Brenden Noblitt, Seth Jaksik |
2026-07-22 |
1,836 |
--
|
|
Summer of Semgrep: Everywhere You'll Find Us at Hacker Summer Camp 2026
|
Carlie Marvel |
2026-07-22 |
1,448 |
--
|
|
Comparing Open-Source AI Code Security Harnesses
|
Isaac Evans |
2026-07-20 |
1,985 |
--
|
|
Grounded or Gamed? We Audited Our Own Cyber Benchmark
|
Brenden Noblitt |
2026-07-17 |
1,926 |
--
|
|
Miasma v3 Hit 4 AsyncAPI Packages — Did NPM's Defenses Work, or Just Get Dodged?
|
Katie Paxton-Fear, Max Vonblankenburg |
2026-07-14 |
946 |
--
|
|
Evaluating GPT-5.6 Luna, Terra, and Sol Against GPT-5.5 for AI Code Security
|
Brenden Noblitt, Erik Buchanan, Jayson DeLancey |
2026-07-13 |
1,068 |
4
|
|
You Can't Reverse Engineer Your Way Out of the AI Supply Chain Problem
|
Isaac Evans, Cris Thomas (Space Rogue), Katie Paxton-Fear |
2026-07-10 |
822 |
4
|
|
So it's your first time at Hacker Summer Camp, and you want to make the most of it
|
Katie Paxton-Fear |
2026-07-08 |
3,042 |
--
|
|
AI-Native vs. AI-Washed: How to Tell the Difference in AppSec Tooling
|
Brandon Green |
2026-07-07 |
1,722 |
--
|
|
Black Hat USA 2026: A Space Rogue Survival Guide
|
Cris Thomas (Space Rogue) |
2026-06-25 |
1,546 |
--
|
|
Introducing Semgrep Guardian: Security for AI-Generated Code
|
Milan Williams |
2026-06-23 |
573 |
4
|
|
We have Mythos at Home: GLM 5.2 beats Claude in our Cyber Benchmarks
|
Katie Paxton-Fear, Seth Jaksik, Brenden Noblitt, Erik Buchanan |
2026-06-22 |
2,117 |
1,113
|
|
3.5x more true positives: How we benchmark AI-powered detection
|
Erik Buchanan, Shelley Wu, Pablo Estrada |
2026-06-12 |
1,421 |
--
|
|
RIP post/preinstall scripts: An obituary for the npm feature only TeamPCP will miss
|
Katie Paxton-Fear |
2026-06-11 |
1,363 |
--
|
|
Making Semgrep rip: How Ripgrep inspired us to shave hours off (some) scans
|
Ben Kettle |
2026-06-10 |
2,895 |
7
|
|
How We Cut Semgrep’s Taint Analysis Time by 75%
|
Austin Theriault |
2026-06-05 |
2,583 |
3
|
|
Miasma v2: Self-Spreading npm Worm Now Uses Malicious binding.gyp file and Compromises 57 Packages
|
Katie Paxton-Fear |
2026-06-04 |
711 |
--
|
|
Announcing Pyro Caml: A Continuous Profiler for OCaml
|
Austin Theriault |
2026-06-02 |
3,477 |
26
|
|
Forking Shai-Hulud: RedHat npm Packages Are The Next Victim After GitHub Actions Compromise and Worm
|
Katie Paxton-Fear |
2026-06-01 |
633 |
--
|
|
28 Years Later: Some Things Changed. The Important Stuff Didn't.
|
Cris Thomas (Space Rogue) |
2026-05-28 |
1,291 |
--
|
|
Security that Ships: The ROI of AppSec for Engineering Teams
|
Jayson DeLancey |
2026-05-27 |
1,555 |
--
|
