Latest AI and tech news
CVE-2026-111497 lives in a Brotli decoder that’s been copied into runtimes, databases, and native packages far beyond Node.js. Here’s where it hides and what to do about it....
You can do everything right and still get compromised. Part four of the Cybersecurity Readiness Month series covers how to contain an attacker, respond fast, and recover cleanly once they’re in....
Node2Shell is an RCE in the Brotli decoder bundled with Node.js which Express, Koa, and Fastify setups reach. Download the latest patch of Node.js to protect your runtime....
Most organizations have security policies, scanners, and incident response plans. Part Three of the Cybersecurity Readiness Month series covers how to find out whether any of it works when something goes wrong....
Two new RCE bugs in PHP’s core runtime affect versions back to 5.4, and Apache/mod_php setups are known exploitable today. A longtime PHP defender explains how the bugs work, why patching is the only real fix, and what to do right now....
Semgrep is now part of Cursor Origin - bringing automated security scanning directly to repositories hosted in Cursor....
Security awareness usually tells you how to avoid trouble. Readiness tells you what to do when trouble finds you....
Coding agents now write code faster than people can review it. AI code review should check every change, and send only the exceptions to a human....
Emma Jin wanted a big-name company on her resume. She joined Semgrep as its first intern instead, and six years later she’s an engineering manager. Here’s why eight former interns took the startup route, what it was like to ship to production, an...
More developers are moving from Claude Code and Cursor to OpenAI's Codex, and it's not about which model scores better but how much code review they’re willing to give up. Semgrep Guardian helps make this possible by adding Codex support....
MCP gives AI agents tools, and Hooks make sure security checks run every time. Here's how Grok Build and Semgrep use both....
Cybersecurity Awareness Month did its job. Twenty years later, people know security matters, and what's missing is action. It's time to rename it Cybersecurity Readiness Month....
We ran Claude Opus 5.5 on 186 real CVE tasks. It wrote working code 94% of the time, but secure code only 55% of the time....
Application security is the practice of securing the software your organisation builds. Here's what an AppSec team actually does, and what it doesn't....
Semgrep Supply Chain now includes Malware Detection and Response Automation, providing end-to-end protection during package compromises....
On September 23, 2026, an attacker published credential-stealing builds of MemTensor's MemOS packages to npm and PyPI. Neither build runs on install, instead both wire the payload into code paths that run anyway, and on the Python side that means the...
Semgrep’s 2026 summer interns worked on four very different problems: backend autoscaling, Jira integrations, program analysis, and memory profiling. Along the way, they shipped real work, navigated the tradeoffs of production engineering, and lear...
Two decades of shift left never covered the thirty years of software already running in production. Here's what Semgrep's research team found pointing frontier models at it, and three things you can do this week....
Most malicious package versions get caught and pulled within hours or days. Most developers have little reason to use a dependency released that recently. A one week cooldown produces a surprisingly large security benefit with very little developer f...
Semgrep Multimodal found 63 manually reviewed IDOR vulnerabilities that Mythos missed....
Everyone is talking about Mythos-class capability. Nobody has defined it yet, so we put Mythos to the same benchmark as other frontier models, open-weight models and custom harnesses. Because "Mythos-class" has become an industry shorthand for a capa...
BSidesLV, Black Hat and DEF CON are infotainment at its finest, and there's far too much of it. We researched 2,295 talks across 2025 and 2026 to find what moves the needle in the AI stack....
Rust crates arrayref (244M downloads) and append-only-vec (4M downloads) were compromised with one added dependency line pointing to proc-macro1, a typosquat of proc-macro2. The malicious code sits in build.rs, which Cargo runs at build time, merely ...
GLM-5.3 just dropped and returns Opus 4.8-level performance for a fraction of the cost. Here’s how it and xAI’s recent Grok models compare in our benchmark....
Pinning GitHub Actions to commit SHAs is an effective supply chain defense, but annoying to do org-wide. Here's how I did it, and what I'd do differently....
Security leaders are asking similar questions about agentic coding and how to scale security testing to enable their software teams to deliver max effort....
A self-propagating npm worm ChainDrop republished 1,557 poisoned versions across 435 packages and many unrelated maintainer scopes in a two-hour burst. This is a pattern that is familiar to incident responders, harvesting secrets, republishing packag...
An analysis of cryptographic failures like improper verification of a cryptographic signature and use of a broken or risky algorithm....
Today we're launching nine pre-built Agentic Workflows that hunt for the subtle authentication, injection, and logic flaws that matter most, covering 70+ CWEs across the OWASP Top 10....
Kimi K3's headline numbers look strong, but precision and enterprise-scale performance tell a different story....
Here's the full Semgrep lineup for Black Hat, BSidesLV, and DEF CON 2026: talks, booth sessions, and an exclusive sticker set worth fighting over....
A comparison of several popular open-source options for AI-assisted vulnerability hunting across LLM-led exploitgen, LLM-skill-boosting, and SAST+LLM hybrids...
Is GLM’s viral score real reasoning, or a lucky shortcut? We built a metric to find out....
On 14 July 2026, malicious versions of three AsyncAPI packages were published to npm: @asyncapi/[email protected], @asyncapi/[email protected], and @asyncapi/[email protected] after an attacker gained push access to the repository's next...
OpenAI rated GPT-5.6 as "High" in cybersecurity capability and we estimate the capability jump helps attackers and defenders symmetrically. Our benchmark results are in line with what we’d expect to see from the continued model's exponential trajec...
AI models, even open-weight ones, are far harder to inspect, verify, or trust than traditional software: we currently lack the tools to reliably detect tampering or backdoors in them. The industry urgently needs independent auditors and provenance st...
Not sure whether to hit BlackHat, BSides, or DEF CON, or all three? This guide breaks down what each one offers, plus go-bag essentials, social battery management, and Vegas survival tips from five (or six) years of Hacker Summer Camp....
Every vendor says they're AI-native now. Not all of them mean the same thing. Here are five questions to bring to any vendor call that will separate the tools that really rebuilt something from the ones that stapled a chatbot to a legacy scanner and ...
Black Hat USA 2026 is almost here, and the annual migration to the Nevada desert is about to begin. If you want to come home with something more valuable than a bag full of vendor swag, you're going to need a plan....
Your fastest growing attack surface is your AI agent. As AI writes more code than ever, AppSec teams are seeing 10x the vulnerabilities and traditional gates can't keep up. Semgrep Guardian is designed to scan and fix AI-generated code the moment it'...
Among models given nothing but a prompt, the best open-weight option beat Claude Opus 4.8....
How we assess AI for vulnerability detection, and what the newest models show....