December 2025 Summaries

Semgrep's partnership with Cursor Hooks highlights a new approach to integrating security tools within software development workflows by focusing on both developers and AI coding agents. The integration aims to ensure that security checks are performed deterministically every time code changes occur, addressing the limitations of relying on AI's stochastic processes for security. Cursor’s Cloud Distribution feature allows AppSec teams to implement Semgrep hooks across developer environments easily, enhancing security compliance and consistency. By using hooks, security checks can be enforced at specific points in an agent's workflow, facilitating automatic code remediation. Future developments plan to introduce security context before code generation, allowing agents to operate with knowledge of safe practices and organization-specific security standards. This collaboration seeks to make security an inherent part of the development process, reducing the burden on developers to manually consider security protocols.

In recent months, there has been a significant increase in supply chain security incidents involving malicious package versions infiltrating organizations through trusted package managers. This surge has forced security teams into emergency response mode, shifting their focus from risk mitigation to incident management. Traditional Software Composition Analysis (SCA) tools, designed to manage dependencies and ensure safe upgrades, have struggled to promptly identify affected environments during such incidents, necessitating the creation of a Software Bill of Materials (SBOM) and extensive auditing. The complexity of these incidents is compounded by multiple affected packages and versions, causing significant disruption and time loss. To address these challenges, Semgrep Supply Chain has introduced advisory impact analysis, which streamlines the process by allowing quick searches for vulnerabilities in an environment and pinpointing affected areas using the Semgrep Pro engine. This development aims to automate and expedite responses to future supply chain security threats, reducing the manual effort and time involved in emergency situations, and represents an evolution in securing supply chains against emerging threats.

Semgrep's guide explores the Agent to Agent (A2A) protocol, a standard for enabling communication between LLM-based software agents, which aids in agentic interoperability by allowing agents to perform specific tasks and coordinate with one another, as exemplified by a travel agent coordinating with flight and hotel agents. The A2A protocol, distinct from the agent-to-tool MCP protocol, leverages JSON-RPC, gRPC, and REST for communication, emphasizing the importance of adopting standards to reduce bespoke coding and improve code review processes. Security concerns are discussed, highlighting risks such as prompt injection, OAuth token vulnerabilities, and serialization issues, all of which require careful implementation to prevent unauthorized access and data leakage. The guide emphasizes the potential revival of capability-based access controls to manage the intricate interactions of LLMs, acknowledging that while A2A's current adoption is limited, interest is growing, particularly among large-scale deployments and foundation model providers. As A2A adoption expands, there is a pressing need for security professionals to anticipate and mitigate associated risks, with the guide offering insights and checklists for auditing A2A implementations.

The Payment Card Industry Data Security Standard (PCI DSS) v4.0.1 represents a significant evolution in compliance, shifting from rigid checklists to a more flexible "Customized Approach" that accommodates modern security practices. This update encourages the use of automated processes and tools like Semgrep to codify policies, manage vulnerabilities, and enforce security controls in real-time, effectively transforming compliance from a bottleneck into an integrated, automated process within the software development lifecycle. By employing techniques like Policy-as-Code, automated Secret Detection, and Dataflow Reachability Analysis, organizations can maintain sustainable compliance, reduce the operational burden of audits, and enhance security without compromising development speed. Leading fintech companies are exemplifying this approach by utilizing such tools to streamline compliance efforts, thus turning audits into routine processes rather than disruptive events.

Vulnerability alerts from Software Composition Analysis (SCA) tools often inundate developers with information, most of which is irrelevant to the actual security of applications, leading to wasted effort and tensions between security and development teams. The traditional SCA tools' approach of treating all vulnerabilities as equally critical without considering whether the affected part of the library is used contributes to this problem. Reachability analysis seeks to address this by assessing whether a vulnerability in a third-party package is actually used or reachable by the application code, thereby reducing unnecessary alerts. There are three types of reachability analysis: dependency reachability, which checks if a package is used at all; function-level reachability, which examines whether a specific vulnerable function is called; and dataflow reachability, which assesses if risky data flows into a vulnerable function call. Dataflow reachability offers deeper insights by determining if a vulnerability could lead to an exploit, depending on how data flows through the code. Effective reachability analysis helps teams focus on real, exploitable issues, minimizing alert fatigue and fostering better collaboration between developers and security teams, while some tools offer limited or slow reachability analysis in practice.

React Blog recently announced the discovery of two additional vulnerabilities, CVE-2025-55184 and CVE-2025-55183, in the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages, following the previously identified React2Shell vulnerability. These new vulnerabilities, while not as severe, include a Denial of Service (DoS) issue that can lead to excessive CPU resource consumption and a source code disclosure risk that could expose sensitive information if certain conditions are met. Despite their limited impact on specific application configurations, it is advised to upgrade to the patched versions of the affected packages and NextJS versions. React versions 19.0.2, 19.1.3, and 19.2.2, along with NextJS patches, address these vulnerabilities. Semgrep Supply Chain customers are protected from both the original React2Shell and the newer issues, with detection rules in place to identify them.

A recently disclosed security advisory from the React team highlights a critical Remote Code Execution (RCE) vulnerability, identified as CVE-2025-55182, which affects several React Server Functions packages and could potentially impact downstream frameworks like next, react-router, and others. This vulnerability, which stems from insecure deserialization of HTTP payloads, allows attackers to execute arbitrary code on servers, posing significant security risks. Hosting providers such as Cloudflare, Vercel, and Railway have implemented firewall rules to mitigate this threat, but developers are advised to update to the latest patched versions to ensure protection. Additionally, Semgrep Supply Chain offers tools to scan codebases for these vulnerabilities, allowing users to quickly identify and address any potential exposures. The React team has provided update instructions to guide affected users in securing their systems, emphasizing the severity of RCE vulnerabilities in enabling unauthorized access and potential exploitation for malicious purposes.

The recent wave of supply chain attacks, exemplified by the Sha1-Hulud incident, has underscored the escalating threat of malicious dependencies in application security, particularly through trusted registries like npm, PyPI, and Go Module. These attacks involve sophisticated malware embedded within third-party code libraries, which are intentionally included in projects but contain harmful functionalities such as data theft and cryptojacking. Semgrep has responded by introducing malicious dependency detection in its Supply Chain product, leveraging data from sources like OSV.dev and GitHub Security Lab to provide rapid updates and protection against these threats. The new feature, now generally available, incorporates customer feedback for improvements, such as policies to block malicious code, API integrations for automation, and Jira integration for managing security findings. This proactive approach aims to mitigate the risks posed by these threats and transform dependency management into a more integrated and automated process, amidst a growing trend of malicious open-source attacks.