September 2025 Summaries

Capture the flag (CTF) competitions exhibit varying levels of difficulty, determined by factors such as CTF Time Weight Ratings, target audience, historical reputation, challenge complexity, and prize offerings. Events with higher CTF Time weights are usually more challenging, while those with lower weights are more accessible. Prestigious competitions like DEF CON CTF and SECCON are known for their high difficulty levels, while beginner-friendly events such as picoCTF and CSAW prioritize educational value. Intermediate competitions like Securinets CTF and BuckeyeCTF offer a balanced challenge, and high-level contests like Hack.lu and SECCON Quals push technical boundaries with sophisticated challenges. The increase in corporate sponsorships has significantly raised prize pools, such as Black Hat MEA's $187,000 pool, indicating growing industry investment in cybersecurity skills development. Organizers are also enhancing geographic accessibility through regional hubs and online participation, although premier events often favor on-site finals to maintain competitive integrity. The evolving landscape of CTFs now includes areas like embedded systems and smart contracts, reflecting the broadening scope of these competitions. Participants are encouraged to build their security portfolios through platforms like Snyk, which offers free security tools for open-source projects, aligning competition experience with career development.

In September 2025, the npm package "postmark-mcp," designed for AI assistants to send emails via the Postmark service, was discovered to have been maliciously modified to exfiltrate email contents by blind-copying them to an external domain. This security breach, which likely started with version 1.0.16, highlights a significant supply chain security incident involving an MCP (Model Context Protocol) server. The backdoor was intended to harvest emails sent through the server, potentially compromising sensitive data like passwords, customer information, and internal communications. Users who installed the package from mid-September 2025 are advised to uninstall it, rotate credentials, review email logs, and block the associated domain to mitigate risks. The incident underscores the need for vigilance in monitoring and managing third-party packages, especially those with high trust and broad permissions in agent toolchains.

Businesses aiming to comply with Payment Card Industry Data Security Standard (PCI DSS) v4.0.1 must focus on effective developer training, which is often neglected. Snyk Learn addresses this gap by providing targeted, interactive, and digestible training modules tailored to real-world vulnerabilities and specific coding mistakes developers encounter. It supports crucial PCI DSS requirements, emphasizing secure coding practices, regular code reviews, and preventative software engineering techniques to mitigate common attacks. Snyk Learn's platform not only enhances the understanding of security concepts and tools but also aligns with industry standards like OWASP and NIST, making compliance with multiple regulations more achievable. By integrating training into the software development lifecycle, Snyk Learn helps prevent vulnerabilities from reaching production, safeguarding sensitive data and meeting compliance objectives.

Snyk has been recognized for the sixth time on the Forbes Cloud 100 list, ranking at #51, highlighting its innovation in the private cloud sector and its commitment to securing AI-native software development. This recognition coincides with Snyk's launch of the AI Trust Platform, designed to ensure trustworthy AI-generated software amidst the increasing use of AI coding assistants, which often introduce vulnerabilities. Snyk's notable achievements over the past year include the expansion through acquisitions of Invariant Labs and Probely, the introduction of Snyk API & Web for modern application security, surpassing $300 million in annual recurring revenue, and serving over 4,500 customers globally, including a significant portion of the Fortune 500. The company aims to continue leading in AI security by hosting the AI Security Summit and emphasizing the integration of trust and innovation in software development.

As artificial intelligence increasingly influences software development, application security (AppSec) teams encounter new challenges such as visibility issues and vulnerabilities in AI-generated code, necessitating a shift from task management to strategic governance. The Snyk AI Security Platform introduces new features to address these challenges, including an Ignore Approval Workflow that allows developers to manage security findings seamlessly while maintaining AppSec oversight, and a CLI Upload feature that ensures comprehensive visibility of local command-line scans. The platform also offers Group by Dependency View to streamline vulnerability prioritization, an Export API for integrating reporting data into internal systems, and Agent Usage to IDE Reports for insights into AI coding assistant usage. Furthermore, Snyk Learn Reports aim to enhance developer security education by providing detailed insights into educational program progress and impact. These capabilities are designed to empower AppSec teams with the tools needed for effective governance and prevention, facilitating secure development in the era of AI.

Labelbox, a leading data factory based in San Francisco, successfully transformed its security operations by integrating Snyk’s AI-powered development workflows, guided by Security DevSecOps Engineer Aaron Bacchi. Initially challenged by a growing backlog of security issues and limited resources, Aaron utilized Snyk Studio combined with Cursor to efficiently clear unresolved high-severity static application security testing (SAST) issues within weeks, boosting confidence through automated validation. This innovative approach allowed Aaron to address vulnerabilities without increasing headcount, thereby freeing up time for strategic initiatives like preventing future vulnerabilities and strengthening Labelbox's security posture. The integration of AI-driven workflows not only streamlined the backlog resolution but also empowered developers to write secure code proactively, transforming the security team from a bottleneck into an accelerator and securing the company's AI-generated code effectively.

Security challenges in software development often arise from a disconnect between development and security teams, who have conflicting priorities and communication styles. Development teams focus on speed and innovation, while security teams prioritize risk mitigation, which can lead to delays and frustrations. This misalignment is exacerbated by differences in terminology, cultural barriers, and tool integration challenges, making collaboration difficult and inefficient. To address these issues, organizations can implement joint planning sessions, create shared Key Performance Indicators, and develop a cross-functional glossary to improve communication and understanding. Additionally, integrating security tools into the development process and providing practical, scenario-based training can help bridge these gaps. Platforms like Snyk offer solutions by creating a common language and providing AI-powered tools that facilitate collaboration and enhance security without compromising development speed.

In September 2025, a significant security breach known as the "Shai-Hulud" attack targeted npm packages, spreading malware designed to exfiltrate cloud credentials, API keys, and other sensitive data through webhook transmissions and GitHub repositories. The attack began with the compromise of ngx-bootstrap and ng2-file-upload packages, which included malicious scripts that executed upon installation, affecting developers' environments by stealing their tokens and secrets. The malicious packages were removed quickly, but the threat extended to other npm packages, impacting a broad range of developers and CI/CD environments. The Snyk security team is actively investigating the incident, offering resources to help detect and mitigate the impact of these attacks. GitHub has issued advisories, and users are urged to treat any affected systems as compromised, rotate all secrets, and perform thorough audits and remediations. This incident follows a series of supply chain attacks in 2025, highlighting the ongoing risks of software supply chain vulnerabilities and emphasizing the importance of robust security measures like two-factor authentication and regular security audits.

Snyk has been recognized as a Leader in the Forrester Wave for Static Application Security Testing (SAST) Solutions, highlighting its innovation, customer impact, and platform breadth in developer-first security. This accolade underscores Snyk's commitment to providing fast, developer-friendly, and AI-future-proof security solutions, which are crucial as software development accelerates with the advent of cloud, microservices, and AI-generated code. Forrester praised Snyk for its AI Security Platform, which includes AI-powered prioritization and autonomous fixes, as well as its enterprise-grade analytics and broad Application Security Testing capabilities. Customers have reported that Snyk is integral to their shift-left strategies, catching vulnerabilities early and preventing them from reaching production. This recognition reaffirms Snyk's role as a trusted partner in AI-driven development, offering developers the necessary tools to code securely and efficiently while providing security leaders with comprehensive risk visibility.

On September 8th, an open-source developer known as ~qix fell victim to a phishing attack that compromised his npm account, allowing an attacker to publish malicious versions of popular npm packages. The attacker used social engineering tactics to gain access, and the malicious code targeted crypto transactions by intercepting and redirecting them to addresses controlled by the attacker. The breach was detected and confirmed on September 9th, leading npm to take down the compromised packages. Developers are advised to check for malware in their dependency trees using shared scripts and to monitor for updates on the incident. This attack highlights the vulnerability of open-source supply chains and the need for enhanced security measures, such as two-factor authentication, to protect maintainer accounts. Snyk provides tools and reports to help developers detect and manage such vulnerabilities, emphasizing the importance of robust open-source security practices.

As the Snyk team prepares for two significant events in October, the DevSecCon Flagship conference and the inaugural AI Security Summit, Brett Smith, a distinguished software developer, shares insights into his career and the focus of his upcoming AI-centric session. With over 25 years in IT, primarily in system administration and security engineering, Smith has been working on securing pipelines against potential threats posed by AI and generative AI technologies. His session, "Agents and MCP Servers: Are the Electric Sheep Safe?", references the blurring line between humans and machines, inspired by "Blade Runner" and "Do Androids Dream of Electric Sheep?". The talk will address new attack surfaces introduced by AI in supply chains and propose strategies for mitigating these risks, particularly focusing on the security of MCP servers and agents. Smith emphasizes the importance of treating AI tools with the same security considerations as traditional software, sharing an "aha!" moment from his experience with an insecure GitHub MCP server authentication. He hopes attendees, including platform engineers, DevOps engineers, developers, and security professionals, will leave with a heightened awareness of AI security challenges. The upcoming DevSecCon 2025 aims to expand knowledge in AI security through expert-led sessions and networking opportunities.