Snyk Blog · News

News listings from Snyk Blog on TechiSeek. 883 public listings.

• Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining (Snyk Blog)
  Two authentication bypass vulnerabilities (CVE-2026-3965, CVE-2026-4047) in the Qinglong task scheduling panel were exploited in the wild t…
• Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478) (Snyk Blog)
  CVE-2026-40478: The Thymeleaf template injection (CVSS 9.1) is conditional. Patch to 3.1.4+ immediately, and audit your code for dynamic vi…
• lightning PyPI Compromise: A Bun-Based Credential Stealer in Python (Snyk Blog)
  A malicious release of the lightning PyPI package ships a credential-stealing Bun payload that runs on import. Snyk has a live advisory. He…
• Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account (Snyk Blog)
  A compromised npm maintainer account triggered an automated burst of over 300 malicious package versions across 323 packages in the AntV da…
• The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised (Snyk Blog)
  A day after the AntV npm supply chain attack, the same campaign appears to have struck `durabletask`, a Microsoft-associated Python package…
• A Day in the Life of a Strategy Co-Op in Snyk’s Boston Office (Snyk Blog)
  Go behind the scenes with Lulu, a Strategy Co-Op at Snyk, and discover a day balancing high-impact AI security projects with a vibrant Bost…
• Laravel Lang Supply Chain Advisory (Snyk Blog)
  Hundreds of historical Laravel Lang Packagist releases were republished with malicious code, putting Composer installs at risk of credentia…
• How Relay Network Adopted AI Coding Securely and Built the Foundation for Agentic Development (Snyk Blog)
  See how Relay Network securely adopted AI coding with Snyk and GitHub Copilot, implementing "secure at inception" to reduce vulnerabilities…
• So You Have an AI Security Budget. Now what? (Snyk Blog)
  An AI security budget should fund more than visibility. The real priority is unified governance and enforcement across agentic development…
• A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope (Snyk Blog)
  A dormant contributor account was used to republish the entire @mastra npm scope, each injected with a single dependency, easy-day-js, that…
• A Day in the Life of an AI Engineer in Snyk's Lisbon Office (Snyk Blog)
  Explore a day in the life of an AI Engineer at Snyk's Lisbon office. See what it's like building AI-powered security tools, collaborating g…
• The full Snyk AI Security Platform, free for open source maintainers (Snyk Blog)
  Open source maintainers are drowning in real vulnerability reports and need help prioritizing, fixing, and shipping remediation faster. Sny…
• What nearly 10,000 developer environments reveal about agentic development risk (Snyk Blog)
  AI coding agents are adding a new layer to the software supply chain. Learn what Snyk found in nearly 10,000 developer environments and how…
• The New Security Control Point: Governing AI Agents Inside the Execution Loop (Snyk Blog)
  AI agents introduce security risk through the actions they take, not just the code they produce. Learn how agent behavior governance helps…
• A Note to Our Customers and Partners (Snyk Blog)
  A note to our customers and partners about Snyk's AI transformation and organizational changes.
• NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence (Snyk Blog)
  NIST’s shift to risk-based enrichment makes one thing clear: modern security teams need more than a single public source. In the AI era, tr…
• Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice? (Snyk Blog)
  Snyk VulnBench JS 1.0: 300 repeated scans show LLM security findings vary by run, while SAST and models catch different vulnerability gaps.
• The Generator Can't Be the Validator: What OpenAI's Hugging Face Incident Proves About AI Security (Snyk Blog)
  OpenAI’s Hugging Face incident is a wake-up call: AI systems can escape their own test harnesses, and vendors can’t be the only ones valida…
• AI Model Risk Intelligence Know Which Models You Can Trust Before You Deploy (Snyk Blog)
  AI model risk depends on how a model is deployed. Learn how Evo combines adversarial testing, attack impact, and deployment context to help…
• Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks (Snyk Blog)
  keyv 6.0.0 and ten related npm releases shipped install-time malware. See affected versions, hashes, detection steps, and safe remediation…
• Stop The Sprawl Snyk Secrets Now Generally Available (Snyk Blog)
  Snyk Secrets is now generally available, bringing contextual ML detection, secure-at-commit prevention, and unified secrets governance to t…
• The Agent Baseline: 35 Controls, but Where Should You Start? (Snyk Blog)
  The Agent Baseline defines 35 controls across six security outcomes—but the right starting point depends on how your organization uses agen…
• Benchmarking Secure-and-Functional Remediation and How Snyk Agent Fix Lifts Frontier-Model Fix… (Snyk Blog)
  A benchmark of secure, functional vulnerability fixes across JavaScript, Java, and Python shows Snyk Intelligence helps frontier models bre…
• Why Your AI Application Is Exposed (Even When Your Scans Come Back Clean) (Snyk Blog)
  AI applications can pass security scans yet remain exploitable through chained attacks across models, tools, data, and business workflows.…
• Is prevention essentially a solved problem? (Snyk Blog)
  Prevention in agent-generated code is architecturally solved—but choosing controls that protect security without slowing development remain…
• So I asked my agent instead… (Snyk Blog)
  Ask your Evo tenant about models, MCP servers, and skills across your AI estate, from the client you already work in.
• Evo ADS Govern Agent Behavior Goes GA: Bringing MCP Usage Under Control (Snyk Blog)
  Evo ADS Govern Agent Behavior is now generally available, starting with MCP Governance. Discover, approve, monitor, log, and block MCP serv…
• Introducing Evo Agentic AppSec: Security That Keeps Up With AI Development (Snyk Blog)
  AI-driven development is outpacing traditional security workflows. Snyk’s Agentic AppSec uses security agents to find, fix, and verify vuln…
• VulnBump: Can AI Agents Fix Vulnerable Dependencies Without Breaking the Build? (Snyk Blog)
  VulnBump tests AI agents on 307 real dependency upgrades. A fix counts only if the vulnerability is gone and the build and tests stay green.
• AI Is Calling In Every Risk You've Accepted: Seven Insights From The AI Security Panel: Unfiltered (Snyk Blog)
  AI is making attacks cheaper and faster, exposing risks organizations already carry. Four security leaders share why machine-speed defense…
• AI Model Risk Depends on What the Model Can Reach (Snyk Blog)
  A model’s risk score is only part of the picture: its impact depends on the data, tools, and actions its application can reach. Learn how s…
• Turn Your Vulnerability Backlog Into Pull Requests With Agentic Remediation (Snyk Blog)
  The Evo Remediation Agent is now in Open Preview, bringing automated dependency resolution to Evo Agentic AppSec. AppSec teams can now run…
• PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): [Updated for… (Snyk Blog)
  Two critical flaws in PHP’s request lifecycle can enable unauthenticated remote code execution. Upgrade to a fixed release or install a ven…