One Brotli decoder bug. A lot of copies. TL;DR - CVE-2026-111497 is an out-of-bounds write in the Brotli decompressor in google/brotli, fixed upstream in 1.2.1. It is not a separate Node, PHP, or npm ...

AI agents are writing code now. That part is settled. The question security teams should be asking is: how do you make those agents write secure code from the start, rather than trying to catch ...

We want using Semgrep to be like hiring an AppSec engineer to do the boring work. To be the best platform for code scanning, Semgrep must go beyond finding issues. It must autonomously remove noise, ...

Are you ready to take your coding skills to the next level and ensure that your code is safe and secure on the internet? This exclusive training led by renowned security expert Tanya Janca will cover ...

Semgrep Supply Chain now covers the whole path for malicious dependencies: detecting exposure within minutes, responding automatically, and blocking malware before it's installed. Org-wide policies ...

In the first part of this series, I argued that after 22 years, it's time to replace Cybersecurity Awareness Month with Cybersecurity Readiness Month. Awareness made sense in 2004, but today everybody ...

It's been a busy week for supply chain incidents. Yesterday the PHP Foundation disclosed PHP2Shell, a vulnerability that has existed in PHP for over a decade. We broke down how that worked in our post ...

You can do everything right and still get compromised. Part four of the Cybersecurity Readiness Month series covers how to contain an attacker, respond fast, and recover cleanly once they’re in. For ...

TL;DR I lay out a case for moving security enforcement into the hands of developers. I show how I and another developer at r2c successfully identified data leakage in our logs, fixed the issue, and ...

Finding vulnerabilities is not the problem anymore. Every code scan, pipeline, and dashboard produces more results than security teams can manage. The real challenge is knowing which vulnerabilities ...

AI coding agents are helping developers ship faster than ever, but they’re also creating a new security challenge: more code is being generated before traditional security tools have a chance to catch ...