4276 articles
4276 ARTICLES
Chainguard launches a ready-to-run STIG scanner with a built-in GPOS SRG InSpec profile, simplifying compliance scans for containers and FedRAMP workflows.
What we believe We’ve been thinking deeply about enterprise security. The operating model that served us for the past decade (collect telemetry, store it, query it, build dashboards to watch it) is no longer keeping pace. We need to shift to the new world: telemetry, context, reasoning, and actions. An approach that produces outcomes. The
Coding agents are privileged insiders — with keys to CI/CD pipelines even as they give rise to ‘slopsquatting.’ Here’s how to govern them.
Part 1: How the Red Agent uncovered a multi-step attack chain allowing SSRF-to-Local-File-Read on a GCP Cloud Run API
An inside look at how the Red Agent, our AI-Powered Attacker, uncovers complex, exploitable risks in the wild
Key Points Introduction In this research, we analyze a clipboard hijacker campaign that is hidden inside a collection of “solutions” and “tools” that claim to give users an unfair advantage. These offers include Solana and Pump.fun sniper bots (automated tools that try to buy new tokens or meme coins faster than other traders), Aviator Predictor […] The post From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker appeared first on Check Point Research.
A supply chain attack compromised all 143 @mastra packages. Chainguard customers stayed protected through malware blocking and source-built libraries.
Chainguard Agent Skills now offers 1,000+ hardened community skills, private registries, and beta hardening for first-party AI agent skills.
Explore a day in the life of an AI Engineer at Snyk’s Lisbon office. See what it’s like building AI-powered security tools, collaborating globally, and enjoying the vibrant culture of Portugal’s capital city.
Businesses of all sizes are dabbling in data and AI. And as they scale, they’re becoming increasingly aware of the need to develop strict data and AI governance oversight and protocols. However, they’re not always interested in purchasing the equipment and software needed to keep their data protected and available onsite. Instead, many are turning to cloud-based ecosystems. In this way, data and AI governance are converging in the cloud. For the most part, this is working to more tightl…
A dormant contributor account was used to republish the entire @mastra npm scope, each injected with a single dependency, easy-day-js, that drops a cross-platform cryptocurrency stealer. Here is how the attack worked, how to check exposure, and how to remediate.
In this blog post you’ll learn how to detect and prevent subdomain takeover – a tactic where threat actors exploit dangling DNS records to redirect traffic to attacker-controlled resources. We’ll explain the issue, how the situation arises, and how you can use various AWS features and services to help mitigate the impact of this tactic.