Semgrep · Blogs

Blogs listings from Semgrep on TechiSeek. 282 public listings.

• Mini Shai-Hulud Resurfaces; Compromised Maintainer of antv, timeago, and size-sensor Packages (Semgrep)
  Malicious packages discovered on NPM started with a compromised maintainer account and spread from @antv/*, timeago, size-sensor, and hundr…
• How We Cut Semgrep’s Taint Analysis Time by 75% (Semgrep)
  Semgrep Pro Engine 1.158.0 ships a redesigned taint analysis engine that cuts P95 scan times by 25%, brings P99 from ~45 to ~35 min, and de…
• Evaluating GPT-5.6 Luna, Terra, and Sol Against GPT-5.5 for AI Code Security (Semgrep)
  We benchmarked OpenAI's GPT-5.6 (Luna, Terra, Sol) against GPT-5.5 for vulnerability detection.
• We benchmarked A LOT of models, here’s how they compare to Mythos (Semgrep)
  Mythos scored 80% precision and 13.9% recall against 275 human-reviewed IDOR labels. See how it ranks next to 22 other model and harness co…
• Mythos: Bad Takes, Facts, and Fear (Semgrep)
  Analysis of Anthropic Mythos and AI vulnerability research: how LLMs are changing exploit generation, bug discovery, and why AppSec teams m…
• Not Your IPC, but node-ipc: npm Hit Again with Supply Chain Attack (But This Time It's Not a Worm) (Semgrep)
  Newly published versions of the node-ipc npm package briefly contained an obfuscated infostealer that harvested developer credentials, clou…
• Introducing Semgrep Agentic Workflows: Automate Deep Vulnerability Hunting at Scale (Semgrep)
  Not long ago, finding a subtle but critical flaw in an unfamiliar codebase could take an experienced pentester days: reading the code, trac…
• Security Like It's 1977: Capabilities for the Modern Agentic Web (Semgrep)
  Explore how capability negotiation for A2A improves AI security by enforcing least privilege, reducing prompt injection risk, and strengthe…
• Kimi K3's Code Security Results Look Competitive - Until You Look at Precision (Semgrep)
  Kimi K3's security benchmarks look competitive, but testing reveals a major precision gap and poor performance on large codebases.
• It’s Time to Rename Cybersecurity Awareness Month (Semgrep)
  Cybersecurity Awareness Month did its job. Twenty years on, awareness isn't the problem, behavior is.
• Making Semgrep rip: How Ripgrep inspired us to shave hours off (some) scans (Semgrep)
  Semgrep 1.162.0 fixes a file targeting bottleneck that caused scans on large repos to take hours, cutting P99 diff scan times from ~60 minu…
• Security Companies Under Attack: Defense in the Agentic Era (Semgrep)
  Mapping the GitHub Actions attack surface through LLM-accelerated Proofs of Concept.
• Miasma v3 Hits AsyncAPI: Is NPM Hardening Working? (Semgrep)
  Miasma v3 compromised 4 AsyncAPI npm packages using a load-time payload with worm capabilities deliberately disabled.
• Malicious Intercom PHP Package Spreads Mini Shai-Hulud Attack to Packagist via Composer Plugin (Semgrep)
  intercom/intercom-php 5.0.2 was compromised and converted into a Composer plugin that exfiltrates credentials at install time, extending th…
• NIST No Longer Enriching CVEs, Signaling Industry-Wide Shift Away from NVD. (Semgrep)
  The NVD changes eliminate CVSS as the single source of truth for many SCA vendors, making reachability essential for prioritization and vul…
• OWASP Top 10 2025: What's New (Semgrep)
  Explore the OWASP Top 10 2025 updates, including supply chain risks and error handling, and see how Semgrep maps SAST, SCA, secrets detecti…
• Miasma v2: Self-Spreading npm Worm Now Uses Malicious binding.gyp file and Compromises 57 Packages (Semgrep)
  Two days later, and Miasma already has a new version. The self-spreading npm worm that first surfaced earlier this week didn't give the cre…
• Security Advisory: $foo compromised on $packagemanager (Semgrep)
  Malicious packages on NPM and PyPI including pgserve, kube-health-tools, xinference, and more are becoming commonplace.
• Rust Crates arrayref & append-only-vec Compromised (Semgrep)
  Popular Rust crates arrayref and append-only-vec were compromised via a typosquatted proc-macro1 dependency that runs malicious code at bui…
• Introducing Malware Detection and Response Automation (Semgrep)
  Semgrep Supply Chain now includes Malware Detection and Response Automation, providing end-to-end protection during package compromises.
• Inside the AI Memories Security Teams Are Writing (Semgrep)
  Security teams write natural-language "memories" to encode institutional knowledge into their Semgrep scans.
• It’s not npm-ver yet: NPM worm Chaindrop hits 400+ packages including jaredwray, servicetitan (Semgrep)
  A self-propagating npm worm ChainDrop republished 1,557 poisoned versions across 435 packages and many unrelated maintainer scopes in a two…
• SAP Cloud Build Tool Packaged A Mini Shai-Hulud Malicious Dependency That Uses Bun (Semgrep)
  “A Mini Shai-Hulud has Appeared.” Step Security reported a new coordinated npm supply chain attack targeting SAP development ecosystem pack…
• Hacker Summer Camp 2026: What 2,295 Talks Reveal (Semgrep)
  We analyzed 2,295 talks from Black Hat, BSidesLV, and DEF CON. AI talks are up 10% and skew offensive, while false positives became the new…
• Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library (Semgrep)
  The PyPI package lightning was compromised in versions 2.6.2 and 2.6.3 with Mini Shai-Hulud themed malicious code to execute credential-ste…
• Preventing Vulnerable Code From Merging Without Blocking Developers (Semgrep)
  AppSec teams that enforce merge-blocking on high-risk vulnerabilities fix significantly more of them.
• Needles and haystacks: Can open-source & flagship models do what Mythos did? (Semgrep)
  We show that none of three flagship or two open-source models find two of the vulnerabilities discussed in the Mythos blog post, without ex…
• GLM-5.3 delivers Opus 4.8-level cybersecurity results at a fraction of the cost (Semgrep)
  GLM-5.3 just dropped and returns Opus 4.8-level performance for a fraction of the cost. Here’s how it and xAI’s recent Grok models compare…
• Introducing Semgrep Guardian: Real-Time Security for AI-Written Code (Semgrep)
  As AI agents write more of your code than ever, Semgrep Guardian scans and fixes vulnerabilities the moment they're introduced, directly in…
• Operationalizing AI-Powered Detection (Semgrep)
  How we turned AI experiments into something customers could rely on in production.
• How Semgrep Multimodal Finds the IDORs Other Tools Miss (Semgrep)
  Semgrep Multimodal found 63 confirmed IDORs Mythos did not report, at 59.9% recall versus 13.9%.
• Grounded or Gamed? We Audited Our Own Cyber Benchmark (Semgrep)
  Our benchmark tests whether LLMs reason about IDOR vulnerabilities or just pattern-match. They're grounded — but every model still misses 7…