The Curious Engineer

All blogs / Security

Semgrep Blog Feed

semgrep.dev/blog

Discover the latest news and updates from our Security Research Staff and Product team for trends in secure coding, application security, and source-code scanning.

SecuritySoftware / engineering practice

’19’20’21’22’23’24’25’26
Posts
317 from 14 May 2019 to 27 Oct 2026
Posting
weekly (111 in the last year)
Kind
company blog
Feed
https://semgrep.dev/blog/rss/

2026 93

  1. You Can Be Aware and Still Get Compromised. Readiness Limits the Damage.
  2. Broccoli2Shell: The One Decoder to Rule Them All
  3. Patch Your Node and Eat Your Brotli Or You Won’t Get Dessert
  4. If you run Apache with mod_php, stop reading and patch now: upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
  5. Your Security Tools Won't Save You. Is Your Organization Actually Ready?
  6. Introducing Semgrep in Cursor Origin
  7. Cybersecurity Awareness Won’t Save You. Readiness Might.
  8. The End Is Nigh for Code Review
  9. "I wanted the big name on my resume": Why our former interns chose a startup anyway
  10. Why Engineers Are Switching to Codex
  11. MCP Gives Agents Tools. Hooks Give Security Control.
  12. It’s Time to Rename Cybersecurity Awareness Month
  13. Claude Opus 5.5 Writes Working Code but Only Half of It Is Secure
  14. What Application Security Actually Does All Day
  15. Introducing Malware Detection and Response Automation
  16. The AI Ecosystem Has Worms Now: Inside the MemTensor Compromise
  17. Meet the Semgrep Interns: Four Projects from Summer 2026
  18. Shift Right? After 20 Years of Shift Left?
  19. Feeling the heat from Malicious Packages? Cool off with Cooldowns
  20. Semgrep Multimodal Goes Beyond Authentication: What we learned from Comparing it with Mythos
  21. We benchmarked A LOT of models, here’s how they compare to Mythos
  22. Hacker Summer Camp 2026: A Longitudinal Study of 2,295 Talks
  23. Rust crates arrayref & append-only-vec compromised via malicious proc-macro1 dependency
  24. GLM-5.3 delivers Opus 4.8-level cybersecurity results at a fraction of the cost
  25. Speedrunning SHA pinning for GitHub Actions org-wide
  26. What Happens to Your AppSec Program When Going from Zero to 60k Lines of Code a Day
  27. It’s not npm-ver yet: NPM worm Chaindrop hits 400+ packages including jaredwray, servicetitan, ornikar, qlik and nebula.js
  28. Crypto is Fine. The Code is Not.
  29. Introducing Semgrep Agentic Workflows: Automate Deep Vulnerability Hunting at Scale
  30. Kimi K3's Code Security Results Look Competitive - Until You Look at Precision
  31. Summer of Semgrep: Everywhere You'll Find Us at Hacker Summer Camp 2026
  32. Comparing Open-Source AI Code Security Harnesses
  33. Grounded or Gamed? We Audited Our Own Cyber Benchmark
  34. Miasma v3 Hit 4 AsyncAPI Packages — Did NPM's Defenses Work, or Just Get Dodged?
  35. Evaluating GPT-5.6 Luna, Terra, and Sol Against GPT-5.5 for AI Code Security
  36. You Can't Reverse Engineer Your Way Out of the AI Supply Chain Problem
  37. So it's your first time at Hacker Summer Camp, and you want to make the most of it
  38. AI-Native vs. AI-Washed: How to Tell the Difference in AppSec Tooling
  39. Black Hat USA 2026: A Space Rogue Survival Guide
  40. Introducing Semgrep Guardian: Security for AI-Generated Code
  41. We have Mythos at Home: GLM 5.2 beats Claude in our Cyber Benchmarks
  42. 3.5x more true positives: How we benchmark AI-powered detection
  43. RIP post/preinstall scripts: An obituary for the npm feature only TeamPCP will miss
  44. Making Semgrep rip: How Ripgrep inspired us to shave hours off (some) scans
  45. How We Cut Semgrep’s Taint Analysis Time by 75%
  46. Miasma v2: Self-Spreading npm Worm Now Uses Malicious binding.gyp file and Compromises 57 Packages
  47. Announcing Pyro Caml: A Continuous Profiler for OCaml
  48. Forking Shai-Hulud: RedHat npm Packages Are The Next Victim After GitHub Actions Compromise and Worm
  49. 28 Years Later: Some Things Changed. The Important Stuff Didn't.
  50. Security that Ships: The ROI of AppSec for Engineering Teams
  51. The AI Hackathon Effect: Faster Builds, Better Demos, and Real Products
  52. Getting Ready for Mythos with Semgrep
  53. Why Do Worms Work
  54. Mini Shai-Hulud Resurfaces; Compromised Maintainer of antv, timeago, and size-sensor Packages Revives Worm Activity
  55. Not Your IPC, but node-ipc: npm Hit Again with Supply Chain Attack (But This Time It's Not a Worm)
  56. Operationalizing AI-Powered Detection
  57. Children of Shai-Hulud: An Analysis of the The Evolution, Delivery and Spread of the TanStack Shai-Hulud Campaign
  58. TanStack Router Packages Hit by Mini Shai-Hulud TheBeautifulSandsOfTime Supply Chain Attack
  59. Dynamically Resolve Dependencies for a Full Picture of Your Inventory
  60. Inside the AI Memories Security Teams Are Writing
  61. AppSec in Pole Position: A Week of Customers, Conversations, and Code Security across EMEA
  62. Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library
  63. Malicious Intercom PHP Package Spreads Mini Shai-Hulud Attack to Packagist via Composer Plugin
  64. NIST No Longer Enriching CVEs, Signaling Industry-Wide Shift Away from NVD.
  65. SAP Cloud Build Tool Packaged A Mini Shai-Hulud Malicious Dependency That Uses Bun
  66. How-to Write Skills That Make Your AI-Generated Code More Secure
  67. Attackers Are Still Coming for Security Companies. Here's Where We Stand.
  68. Security Advisory: $foo compromised on $packagemanager
  69. Mythos: Bad Takes, Facts, and Fear
  70. Mythos & Semgrep
  71. Needles and haystacks: Can open-source & flagship models do what Mythos did?
  72. Semgrep chosen to be part of OpenAI’s Trusted Access for Cyber Program
  73. Security Should Be the Path of Least Resistance
  74. Codebase-Aware Reachability Analysis Coverage for Rust
  75. Preventing Vulnerable Code From Merging Without Blocking Developers
  76. Axios Supply Chain Incident: Indicators of Compromise
  77. The best free, open-source supply-chain security tool? The lockfile (updated 2026)
  78. Client SDKs Can Be a Supply Chain Blind Spot
  79. Security Companies Under Attack: Defense in the Agentic Era
  80. Hackers Supply Chain Attack Moves From npm to PyPI as Trivy Breach Extends into LiteLLM Package
  81. Attackers Can't Have All the Advantage: Introducing Semgrep Multimodal
  82. Will there be more security engineers in the future, or fewer?
  83. Introducing Semgrep Custom Workflows
  84. Accelerate and Automate Remediation with Semgrep Autofix
  85. Semgrep x Cursor: Introducing Cursor Plugins
  86. Open Source Security: Chaos, Collaboration, and the Cost of “Free”
  87. OpenClaw Security Engineer's Cheat Sheet
  88. OWASP Top 10 2025: What's New
  89. Security Like It's 1977: Capabilities for the Modern Agentic Web
  90. New Sandbox Escape Affecting Popular nodejs Sandbox library vm2
  91. AI Can Do More Than Build Web Apps: What Hardware Hacking Teaches Us About LLM Capabilities
  92. Your Window of Exposure is the Attacker's Window of Opportunity
  93. Choosing AI AppSec Tools: 9 Deciding Factors

2025 55

  1. Semgrep × Cursor Hooks: Making Security Reliable for Agents
  2. Respond to Malware Incidents Faster with Advisory Impact Analysis in Semgrep Supply Chain
  3. A Security Engineer's Guide to the A2A Protocol
  4. From Gatekeepers to Guardrails: Automating Your PCI DSS v4.0.1 Strategy
  5. What You Should Know About Dependency Reachability in SCA
  6. New React2Shell Offspring Patched: React Server Components (DoS) and Source Code Exposure
  7. Remote Code Execution Security Bug in React Server Components Patched
  8. Detect Open Source Malware Attacks with Semgrep Supply Chain
  9. What a Hackathon Reveals About AI Agent Trends to Expect in 2026
  10. Sha1-Hulud: The Second Coming of the NPM Worm is Digging For Secrets
  11. Secrets Story: The Prefixed Secrets That Tried%20to%2BGet\nAway
  12. Security Regulations: From Scary Stories to Strategic Advantage
  13. Catching IDORs, Broken Authorization, and Other Logic Issues with Semgrep AI-Powered Detection
  14. Boosting Security Scan Performance for Monorepos with Multicore Parallel Processing
  15. Five Considerations When Building Cross-Platform Tools for Windows and macOS
  16. Semgrep Community Edition Fall Release 2025
  17. Through a Scanner Falsely: When AI-reported Critical Vulnerabilities Aren’t
  18. Can LLMs Detect IDORs? Understanding the Boundaries of AI Reasoning
  19. 7 Things We Learned from the EU’s Cybersecurity Threat Landscape 2050 Report
  20. How Semgrep & StackHawk Help AppSec Teams Prioritize Real Risks
  21. Semgrep recognized in the 2025 Gartner® Magic Quadrant™ for Application Security Testing
  22. So the first malicious MCP server has been found on npm, what does this mean for MCP security?
  23. Enterprise Scale Code Scanning: Semgrep Managed Scans Crossed 1 MILLION Weekly Scans
  24. A Security Engineer's Guide to MCP
  25. Security Advisory | NPM Packages Using Secret Scanning Tools to Steal Credentials
  26. Our AI Assistant is handling 60% of incoming triage work for customers
  27. Security Alert | chalk, debug and color on npm compromised in new supply chain attack
  28. MCP: Model, Context… Propaganda? What security teams need to know about the latest hyped up AI tech
  29. Finding vulnerabilities in modern web apps using Claude Code and OpenAI Codex
  30. Security Alert | NX Compromised to Steal Wallets and Credentials
  31. Fix What Matters, Faster: How Semgrep and Sysdig Are Unifying Security from Code to Runtime
  32. Finding More Zero Days Through Variant Analysis
  33. Comparing Semgrep Community Edition and Semgrep Code for Static Analysis Sensitivity
  34. Taming the elephant: Introducing reachability analysis for PHP
  35. Imagine zero false positive SAST
  36. Benchmarking Semgrep Community Edition Performance Improvements
  37. From idea to (secure) app: Semgrep + Replit
  38. AppSec for Builders: A Manifesto for the Future of Secure Code Development
  39. Beyond vulnerabilities: Detect malicious dependencies in your supply chain
  40. Giving AppSec a Seat at the Vibe Coding Table
  41. Maturing Your Application Security Program Survey
  42. London calling: Highlights from the 2025 cloud & cyber security expo
  43. 🚨 Popular GitHub Action tj-actions/changed-files is compromised
  44. Upgrading Semgrep from OCaml 4 to OCaml 5
  45. The Future of SaaS Security: AI-Driven, Fast, and Secure
  46. Take control of sensitive code without developer frustration
  47. A Technical Deep Dive into Semgrep’s JavaScript Vulnerability Detection
  48. Code to cloud noise reduction - Prioritizing code security with Semgrep & Wiz
  49. Beyond Benchmarks: How Semgrep Redefines Javascript Security
  50. 5 Ways SAST and SCA help fintech companies innovate securely
  51. Series D announcement
  52. Announcing an AI AppSec engineer that users agree with 95% of the time
  53. How we built an AppSec AI that security researchers agree with 96% of the time
  54. Why AI-Powered Memories are the Future of SAST
  55. Automating Security Workflows with the Semgrep Policy Management API

2024 52

  1. Important updates to Semgrep OSS
  2. Less effort, more insight: Introducing Dependency Graph for Supply Chain
  3. Semgrep Supply Chain announces dataflow reachability support for 10 languages
  4. Bringing Semgrep Managed Scanning to GitLab: automated code scanning at scale
  5. Help us rename Semgrep OSS!
  6. Announcing Kotlin Reachability: Expanding the reach of Semgrep’s reachability
  7. Driving enterprise adoption of AI code security with Semgrep Assistant
  8. Easily create custom SAST guardrails with human language and Semgrep Assistant (AI)
  9. New insight into backlogs, developer engagement, and security posture
  10. Choosing a static analysis tool
  11. Conclusion: Security Champions
  12. Exploit exploitability: prioritize supply chain findings with EPSS
  13. Does your LLM thing work? (& how we use promptfoo)
  14. Security Champions: Metrics & Data
  15. Announcing AI-assisted remediation guidance on every PR
  16. Redefining security coverage for Python with framework-native analysis
  17. The tech behind Semgrep Assistant’s triage and remediation guidance
  18. A day in the life: Supply Chain Security Researcher
  19. Bringing more Semgrep capabilities to BitBucket and Azure DevOps
  20. Teaching security champions
  21. Engage your champions
  22. Recruiting security champions
  23. AppSec guides, not gates: Introducing secure guardrails with Semgrep
  24. Fix today’s vulnerabilities and prevent tomorrow’s with secure guardrails
  25. Sense and (path) sensitivity: My experience adding a new feature as a Semgrep intern
  26. (Over)Communication with your security champions
  27. Recognizing and rewarding security champions
  28. Not just another Jira integration
  29. CocoaPods vulnerabilities highlight risks in dependency managers
  30. Building security champions
  31. The CVE program’s new rules: will they affect your vulnerability management?
  32. Protect your code from the Polyfill supply chain attack
  33. Introducing Semgrep’s Community-Oriented Twitter Account
  34. Semgrep Quarterly Launch: scaling your AppSec impact just got easier
  35. Rapidly deploy code scans across your organization with Semgrep managed scanning
  36. Overrated and underperforming: transitive reachability analysis
  37. Announcing Semgrep Code Search (public beta)
  38. LSP.js: Using Wasm and JavaScript to support OCaml on Windows
  39. Introducing Semgrep Academy: the door to cyber security for everyone
  40. Structure Mode: Never write an invalid Semgrep rule again
  41. Announcing custom rules for Semgrep Secrets
  42. What it takes to make shift left work
  43. Three key learnings for AppSec teams from the XZ backdoor
  44. Securing CodeQL queries with Semgrep
  45. 10x your AppSec program with Semgrep Assistant
  46. Semgrep Code brings modern static analysis to C/C++
  47. Why SAST tools need to be customizable to be useful
  48. Enhancing developer happiness: The impact of identifying code-specific issues
  49. Security headers for ASP.Net and .Net CORE
  50. Comparing Reachability Analysis methods: Semgrep's distinct approach
  51. HackerOne partners with Semgrep to combine expert code review with powerful automation
  52. Continuous learning

2023 34

  1. Security scanning at ludicrous speed
  2. You do not need to do DAST in a pipeline to do DevSecOps
  3. Efficient Dependency Management: Leveraging Manifest Files, Lockfiles, and SemVer Specifications
  4. Semgrep Fall '23 Launch: improved coverage + enterprise fit
  5. Go beyond regex: introducing Semgrep Secrets
  6. My Very, Very, VERY HONEST Internship Experience @ Semgrep
  7. Much ado about cURL
  8. Announcing Semgrep Supply Chain’s beta support for C#
  9. DevSecOps worst practices – the series
  10. Preventing secrets in code
  11. Should security engineers care about transitive supply chain vulnerabilities?
  12. Choosing API Security Tools
  13. The Difference Between SCA and Supply Chain Security
  14. Guardrails for PromQL using Semgrep
  15. Why We Hack Purple and I are joining Semgrep
  16. The indomitable maintainer spirit versus the indifferent cruelty of JavaScript
  17. AI & Cybersecurity: Learnings from three months of Semgrep Assistant
  18. How we resolved the ‘HTTP request failed: timeout’ issue in OCaml
  19. Semgrep’s VS Code extension: powerful SAST as fast as linting
  20. Expanding Semgrep Supply Chain into Dependency Intelligence and License Compliance
  21. The journey of a language from experimental to GA in Semgrep
  22. Cross-compiling OCaml to JS and Wasm: How we made the Semgrep Playground Fast
  23. Unlocking advanced security for all: Semgrep’s latest update
  24. Semgrep now supports Cairo 1.0
  25. Announcing Semgrep’s support for Go in Pro Engine
  26. Announcing Semgrep’s experimental support for Julia
  27. Semgrep, a code & supply chain security search engine, raises Series C
  28. The birth of Semgrep Pro Engine
  29. We put GPT-4 in Semgrep to point out false positives & fix code
  30. Using AI to write secure code with Semgrep
  31. Announcing Semgrep’s beta support for Rust
  32. Developer-focused results and improved coverage with Semgrep Pro rules
  33. Announcing Semgrep Code: SAST designed and built for engineers
  34. XML Security in Java

2022 24

  1. Releasing Semgrep 1.0
  2. Need for speed: static analysis version
  3. Building an enterprise-ready, scalable security program using Semgrep
  4. Powerfully autofixing code with Semgrep's new AST-based approach
  5. A deep dive into Semgrep Supply Chain
  6. Fully loaded: testing vulnerable PyYAML versions
  7. It's time to ignore 98% of dependency alerts. Introducing Semgrep Supply Chain.
  8. Software supply chain security is hard
  9. Announcing Semgrep's experimental support of Swift
  10. Demystifying Taint Mode
  11. Shoulda, Woulda...Coulda
  12. Testing autofix behavior of SAST rules
  13. Security scanning with Semgrep in CI
  14. My experience interning at r2c
  15. Announcing Semgrep's general availability support of PHP
  16. Write custom rules with the new Playground
  17. Introducing DeepSemgrep
  18. Semgrep's May 2022 updates
  19. Tips and tricks for writing fixes
  20. Semgrep Spring 2022 meetup recap
  21. Scaling Semgrep rule coverage by spidering language documentation
  22. Semgrep's February 2022 Updates
  23. Keep your rules simple with symbolic propagation
  24. The OWASP API Security Top Ten: API1:2019 Broken Object Level Authorization

2021 26

  1. Understanding and mitigating the Log4Shell vulnerability
  2. Scanning Shell Scripts With Semgrep
  3. New, high-signal rules for the JavaScript ecosystem
  4. Semgrep: a static analysis journey
  5. Announcing general availability of C#
  6. Semgrep App's Fall 2021 updates
  7. Semgrep's Fall 2021 Updates
  8. Taint mode is now in beta
  9. Seattle Java User Group: Detect complex code patterns using Semgrep
  10. Protect Your GitHub Actions with Semgrep
  11. Recording: Semgrep Summer 2021 Meetup
  12. BSides Las Vegas: the power of guardrails
  13. Slack on scaling static analysis with Semgrep
  14. r2c's Series B funding
  15. JavaScript static analysis comparison: ESLint vs Semgrep
  16. Introducing Semgrep for GitLab
  17. Python static analysis comparison: Bandit vs Semgrep
  18. Announcing C# alpha support
  19. 🤫 Don't leak your secrets
  20. How we made Semgrep rules run on Semgrep rules
  21. Jenkins Meetup
  22. Should random() be banned?
  23. Appsec Development: Keeping it all together at scale
  24. Executable XSS cheat sheets for popular web frameworks
  25. r2c named Disruptive Innovator by Forbes
  26. Four levels of maturity that bridge the AppSec / engineering divide

2020 27

  1. When DevSecOps goes wrong
  2. Announcing Ruby GA support
  3. Bay Area OWASP Meetup presentation
  4. Using Bento individually and on team projects
  5. Experimental feature: generic pattern matching
  6. Exploiting dynamic rendering engines to take control of web apps
  7. Introducing Semgrep and r2c
  8. Fixing leaky logs: how to find a bug and ensure it never returns
  9. The future of AppSec and why I joined r2c
  10. Writing Semgrep rules
  11. Not all attacks are equal: understanding and preventing DoS in web applications
  12. r2c meetup on writing Semgrep rules
  13. Type-awareness in semantic grep
  14. How to prevent HTML email injection in Python web apps
  15. Hardcoded secrets, unverified tokens, and other common JWT mistakes
  16. Be careful what you request for
  17. Semgrep: Stop grepping code
  18. Pain-free custom linting: why I moved from ESLint and Bandit to Semgrep
  19. Preventing SQL injection: a Django author's perspective
  20. Semgrep at Hella Secure HellaConf 2020
  21. Silicon Valley Cyber Security: Detect complex code patterns using semantic grep
  22. Improving ReDoS detection and finding more bugs using Dlint and r2c
  23. SF Python: writing robust Flask apps
  24. Bento 0.9: Checks for a high-severity Python vulnerability and Jinja templates
  25. Bento check: Catch catastrophic backtracking ReDoS bugs
  26. Finding Python ReDoS bugs at scale using Dlint and r2c
  27. Bento 0.8: Updated workflows and new specialty checks

2019 6

  1. Bento check: keeping your cookies safe in Flask
  2. Flask check: send_file() with a file handle
  3. Our quest to make world-class security and bugfinding available to all developers, for free
  4. Three things your linter shouldn’t tell you
  5. DEF CON 27 workshop on finding vulnerabilities at scale
  6. Surprising subtleties of Docker permissions