One Brotli decoder bug. A lot of copies. TL;DR - CVE-2026-111497 is an out-of-bounds write in the Brotli decompressor in google/brotli, fixed upstream in 1.2.1. It is not a separate Node, PHP, or npm ...
AI agents are writing code now. That part is settled. The question security teams should be asking is: how do you make those agents write secure code from the start, rather than trying to catch ...
TL;DR I lay out a case for moving security enforcement into the hands of developers. I show how I and another developer at r2c successfully identified data leakage in our logs, fixed the issue, and ...
None of the three Grok 4.6 variants beat the frontier leaders, but they do perform similarly to Kimi K3 and older Claude Opus models at a fraction of the price. Grok 4.6 Exacto’s 35.5% F1 is very ...
We want using Semgrep to be like hiring an AppSec engineer to do the boring work. To be the best platform for code scanning, Semgrep must go beyond finding issues. It must autonomously remove noise, ...
It's been a busy week for supply chain incidents. Yesterday the PHP Foundation disclosed PHP2Shell, a vulnerability that has existed in PHP for over a decade. We broke down how that worked in our post ...
In the first part of this series, I argued that after 22 years, it's time to replace Cybersecurity Awareness Month with Cybersecurity Readiness Month. Awareness made sense in 2004, but today everybody ...
You can do everything right and still get compromised. Part four of the Cybersecurity Readiness Month series covers how to contain an attacker, respond fast, and recover cleanly once they’re in. For ...
Finding vulnerabilities is not the problem anymore. Every code scan, pipeline, and dashboard produces more results than security teams can manage. The real challenge is knowing which vulnerabilities ...
This post describes the thought process behind writing a new Semgrep rule and gives a methodology for doing so effectively. There’s no one right way or process for writing a Semgrep rule. Do what ...
Join Semgrep and the iconic Hog Island Oyster Company for a one-of-a-kind virtual experience where you'll learn to expertly shuck oysters with guidance from the team behind California’s most ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results