2020–2026
1,404 posts
2026 109
October 2026
- PHP2Shell Won't Be the Last. Here's Where the Next One Will Show Up First.
- Snyk UNFILTERED: Inside Our First-Ever Customer Summit
- PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now
- Turn Your Vulnerability Backlog Into Pull Requests With Agentic Remediation
- AI Model Risk Depends on What the Model Can Reach
- AI Is Calling In Every Risk You've Accepted: Seven Insights From The AI Security Panel: Unfiltered
- VulnBump: Can AI Agents Fix Vulnerable Dependencies Without Breaking the Build?
- Introducing Evo Agentic AppSec: Security That Keeps Up With AI Development
- Frontier models found the vulnerabilities. Only the attacker found the chains.
- Autonomous Attacks Are Already Here. The Defense Has to Match Their Speed.
- Why AI Coding Agents Keep Writing Broken Access Control
September 2026
- What Is Agentic AppSec?
- Evo ADS Govern Agent Behavior Goes GA: Bringing MCP Usage Under Control
- Your Vulnerability Backlog Is No Longer Technical Debt, It’s an Attack Surface
- So I asked my agent instead…
- The AI Hurricane Is Here
- Is prevention essentially a solved problem?
August 2026
- Why Your AI Application Is Exposed (Even When Your Scans Come Back Clean)
- Remediation Agents, Demystified: Why Fixing Beats Finding
- Benchmarking Secure-and-Functional Remediation and How Snyk Agent Fix Lifts Frontier-Model Fix Rates by over 14%
- The Agent Baseline: 35 Controls, But Where Should You Start?
- Show, Don't Tell: What Evo Continuous Offensive Security Found in a Real Enterprise SaaS
- Continuous Offensive Security & AI Pentesting: 20 FAQs
- Stop The Sprawl Snyk Secrets Now Generally Available
- Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks
- A First Look at Evo Agentic AppSec: Agentic Remediation and Malicious Code Defense
- AI Model Risk Intelligence Know Which Models You Can Trust Before You Deploy
- Evo Continuous Offensive Security Is Here Pentesting Grade Coverage For The 350 Days A Year You Aren't Testing
July 2026
- Secure at Inception: Announcing the Snyk Studio Integration for Snowflake Cortex Code
- The Attacker Never Sleeps, Neither Can Your Testing
- Stadium Summer: The Snyk Connect Fan Zone Tour
- The Generator Can't Be the Validator: What OpenAI's Hugging Face Incident Proves About AI Security
- What Is AI Pentesting and How Does It Work?
- Symlinks Are Still Scary (And Yes, You Can Commit Them to Git)
June 2026
- Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?
- NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence
- A Note to Our Customers and Partners
- What nearly 10,000 developer environments reveal about agentic development risk
- The New Security Control Point: Governing AI Agents Inside the Execution Loop
- Announcing Agentic Development Security (ADS)
- When a vendor's breach becomes yours: lessons from the Klue incident
- The full Snyk AI Security Platform, free for open source maintainers
- A Day in the Life of an AI Engineer in Snyk's Lisbon Office
- A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope
- The Government Just Banned an AI Model. An Engineer's Perspective.
- When a Government Pulls an AI Model: What the Fable 5 and Mythos 5 Suspension Means for Security Teams
- Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp
- Type Level Security: The future of secure AI code generation?
- So You Have an AI Security Budget. Now what?
- The New Security Risks of the Agentic Development Lifecycle
- Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection
- Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages
May 2026
- How Relay Network Adopted AI Coding Securely and Built the Foundation for Agentic Development
- Fix SCA issues at scale in your terminal with Snyk Remediation Agent in the CLI
- Continuous Offensive Security: The Line We've Been Walking
- Laravel Lang Supply Chain Advisory
- Securing The AI Revolution: How Snyk And Our Partners Are Scaling For The Future
- A Day in the Life of a Strategy Co-Op in Snyk’s Boston Office
- The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised
- Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account
- Malicious node-ipc versions published to npm in suspected maintainer account compromise
- TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack
April 2026
- lightning PyPI Compromise: A Bun-Based Credential Stealer in Python
- "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages
- Bridging the Gap to Autonomous Fixes: Snyk and Atlassian Unveil Intelligent Remediation for Jira
- Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)
- Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers
- Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining
- Introducing the New Agentic Architecture for Snyk Agent Fix: Faster, Smarter, and More Secure
- Hardcoding Security into Every Commit: The Future of Snyk Secrets
- JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up?
- Governing Security in the Age of Infinite Signal – From Discovery to Control
- Secure What Matters: Scaling Effortless Container Security for the AI Era
- You Patched LiteLLM, But Do You Know Your AI Blast Radius?
- Building AI Security with Our Customers: 5 Lessons from Evo’s Design Partner Program
March 2026
- Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT
- The 5 Principles of Snyk’s Developer Experience
- From Discovery to Defense: Why AI Red Teaming Is the Next Step After AI-SPM
- How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM
- Introducing Agent Security
- The Next Era of AppSec: Why AI-Generated Code Needs Offensive Dynamic Testing
- AI Is Building Your Attack Surface. Are You Testing It?
- Snyk Opens San Francisco Innovation Hub
- Securing the Agent Skills Registry: How Snyk and Tessl Are Setting the Standard
- I Read Cursor's Security Agent Prompts, So You Don't Have To
- The 89% Problem: How LLMs Are Resurrecting the "Dormant Majority" of Open Source
February 2026
- The Rise of the AI Security Engineer: A New Discipline for an AI-Native World
- Snyk and uv, Better Together
- Fetch the Flag CTF 2026: Official Challenge Write-Ups & Community Highlights
- Claude Code Security: A Welcome Evolution in the Remediation Loop
- How “Clinejection” Turned an AI Bot into a Supply Chain Attack
- Snyk and Cline: Securing the Future of Autonomous Coding
- Weaving Security into the Flow: New Snyk Studio Capabilities Power the AI Security Fabric
- Securing the Agent Skill Ecosystem: How Snyk and Vercel Are Locking Down the New Software Supply Chain
- Exploitability Isn’t the Answer. Breakability Is.
- The Future of AI Agent Security Is Guardrails
- From Acceleration to Exposure: Why AI Demands Mature AppSec
- Why Your “Skill Scanner” Is Just False Security (and Maybe Malware)
- How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware
- 280+ Leaky Skills: How OpenClaw & ClawHub Are Exposing API Keys and PII
- Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise
- Introducing the AI Security Fabric: Empowering Software Builders in the Era of AI
- The Prescriptive Path to Operationalizing AI Security
- Snyk Advisor is Reshaping Package Intelligence on Snyk Security Database
January 2026
- 4 Reasons Why CTFs Are One of the Best Ways to Grow in Cybersecurity
- Live From Davos: The End of Human-Speed Security
- ServiceNow's Virtual Agent Vulnerability Shows Why AI Security Needs Traditional AppSec Foundations
- Beyond Detection: Building a Resilient Software Supply Chain (Lessons from the Shai-Hulud Post-Mortem)
- Secure by Default: Why Snyk and Augment Code are the New Standard for AI Development
2025 128
December 2025
- The Holiday Whisper: Shai-Hulud 3.0
- Evo Adds CycloneDX Support to Give Full AI Visibility
- Old AI Security vs Evo: Watch Agentic Security Replace Weeks of Manual Work
- How Snyk Helps Federal Agencies Prepare for the Genesis Mission Era of AI-Driven Science
- Run AutoMCP To Supercharge Your AI Agent with Libraries MCP Servers
- Security Advisory: Critical RCE Vulnerabilities in React Server Components (CVE-2025-55182)
- Accelerating innovation with AWS: Snyk selected as an AWS Pattern Partner
- When Speed Meets Security: Snyk Studio for Kiro
November 2025
- Snyk Log Sniffer: AI-Powered Audit Log Insights for Security Leaders
- SHA1-Hulud, npm supply chain incident
- Scaling AI Security: How Evo Complements New Agentic Tools
- How Snyk Studio for Qodo Is Closing the AI Security Gap
- Why Threat Modeling Is Now Even More Critical for AI-Native Applications
- Anthem Awards 2025: Snyk Learn Recognized for Commitment to Secure AI Development
- Beyond Automation: Securing Low-Code Agentic AI with MCP Guardrails
- Snyk and Continue Partner to Embed AI-Powered Security into Every Step of the Developer Workflow
- Automated Package-Publication Incident IndonesianFoods in the NPM Ecosystem Linked to Crypto Reward-Farming Scam
- Organizations Achieve 288% ROI with The Snyk AI Trust Platform, According to New Forrester TEI Study
- Secure by Design: The Future of Threat Modeling for AI-Native Applications
- The Agentic OODA Loop: How AI and Humans Learn to Defend Together
- Snyk Studio brings security scanning and automated fixes to Factory's Droids
- Beyond the Scan: The Future of Snyk Container
- Snyk Studio: Now for All Customers, Powering Secure AI Development at Scale
October 2025
- DevSecCon 2025 Recap: Securing the AI Revolution Together
- Why We Built Evo — From My Heart
- Increasing Agility & Flexibility: How Mercato Solutions tackles the application security vs. flexibility conundrum with Snyk
- Snyk and Cognition partner to enhance security for AI-native development
- Beyond the Hype: 5 Major Reasons to Attend DevSecCon 2025
- Snyk Named a Leader in the 2025 Gartner® Magic Quadrant™ for Application Security Testing
- Phishing Campaign Leveraging the NPM Ecosystem
September 2025
- The Ultimate Guide to Upcoming CTFs: From Beginner to Elite Hacker in 6 Months (October 2025 - April 2026)
- Malicious MCP Server on npm postmark-mcp Harvests Emails
- How Snyk Learn Helps You Meet PCI DSS v4.0 Developer Training Requirements
- Snyk Ranked #51 on 2025 Forbes Cloud 100 List
- Secure Your AI Workflows: New Governance & Visibility Features from Snyk
- From Two Years to Two Weeks: How Labelbox Erased Its Security Debt with Snyk's AI-Accelerated Remediation
- Speaking Different Languages: How to Align Dev and Sec Teams Effectively
- Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack
- Snyk Named a Leader in the 2025 Forrester SAST Wave: SAST Solutions, Q3 2025
- npm Supply Chain Attack via Open Source maintainer compromise
- What an 'Aha' Moment with an Org Admin Token Taught One DevSecCon Speaker About AI Security
August 2025
- Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident
- Prioritize with Snyk’s Open Source Vulnerability Experience
- AI Agents in Cybersecurity: Revolutionizing AppSec
- Agentic Container Security with Snyk MCP Server
- Meeting the AI Mandates with Confidence: Why Federal Teams Trust Snyk
- From Ideas to Impact: How the Bay Area Is Shaping the Future of Secure AI
- Snyk Supercharges API Discovery with New Akamai Integration
- Snyk Joins CISA's Secure by Design Pledge
- The Hidden Costs of False Positives in Healthtech Security
- Secure at Inception: Introducing New Tools for Securing AI-Native Development
- When “Private" Isn't: The Security Risk of GPT Chats Leaking to Search Engines
July 2025
- Fend Off AI Fatigue with the Snyk AI Trust Platform
- Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware
- Navigating Enterprise AI Implementation: Risks, Rewards, and Where to Start
- Cursor IDE Malware Extension Compromise in $500k Crypto Heist
- Minimizing False Positives: Enhancing Security Efficiency
June 2025
- Fixing Fix Fatigue: Building Developer Trust for Secure AI Code
- Understanding CRA Compliance: Overcoming Challenges with an Integrated Security Testing Approach
- Why AI Trust Will Shape Your Next Decade of Software Development
- Scan your AI-generated code from Cursor using Model Context Protocol (MCP)
- Building AI Trust with Snyk Code and Snyk Agent Fix
- The New Threat Landscape: AI-Native Apps and Agentic Workflows
- Announcing a Dedicated Snyk API & Web Infrastructure Instance for Asia-Pacific
- Why ANZ Technology Leaders Are Rethinking How AI, Speed, and Security Intersect
- Finding Software Flaws Early in the Development Process Provides Clear ROI
- Transform Your AppSec Program With the Power of Snyk Analytics
- Build Fast, Stay Secure: Guardrails for AI Coding Assistants
- Snyk for Government Achieves FedRAMP Moderate Authorization: A Milestone for Secure Government Software
- Humans at the Center: Redefining the Role of Developers in an AI-Powered Future
- From Risk to Resilience: Achieving HIPAA Standards in Your App
- The Future of Developer Upskilling Is Human-Led, AI-Supported
- AI Trust in Action: How Snyk Agent Redefines Secure Development
May 2025
- Scaling Security Education with Snyk's New Learn Add-on
- Welcome-to-The New Era of AI-Driven Development
- AI Is Reshaping Software. Is Your Security Strategy Keeping Up?
- Welcome to Snyk Labs: Charting the Course for AI-Native Security
- Introducing the Snyk AI Security Platform
- Snyk Learn in the Exosphere: Securing Space at HackSpaceCon
- Snyk Report shows 88% of CISOs are concerned with current state of U.S. cyber readiness
- Security Testing for Single-Page Applications (SPAs)
- Snyk @ RSAC 2025
- Driving AI Security Innovation: Snyk Enhances Global Channel & GSI Partner Program
- Learn About Open Source Security Risks With the New Snyk Learn Learning Path
- Secure AI-Generated Code at Speed with Snyk and ServiceNow
April 2025
- Black Hat Asia 2025: My Journey as a Reviewer, Speaker & Community Connector
- Snyk Ushers in the Future of DAST: AI-Driven Security for the Age of AI-Driven Development
- Snyk’s Statement on the MITRE CVEs Program Funding Update
- Snyk Partners with Nova8 to Empower Secure Development Across Latin America
- Snyk Security Solution Now Integrated into Google Cloud's Gemini Code Assist
- Get Off My Lawn and Fix Your Vulnerabilities!
- Q&A Session with Snyk & John Hammond: Your Fetch the Flag Questions, Answered
March 2025
- Governance in DevSecOps: Measuring and Improving Security Outcomes
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- Overcoming AppSec Challenges in FinServ: How CIBC Balances Speed, Security, and Compliance
- Building a Culture of Secure Coding: Empowering Developers to Build Resilient Software
- Unburdening Developers From Vulnerability Fatigue with Snyk Delta Findings
- Reconstructing the TJ Actions Changed Files GitHub Actions Compromise
- AI Risk Management: Benefits, Challenges, and Best Practices
- Responding and remediating: Best practices for handling security alerts
- Snyk and ServiceNow: Streamlining Vulnerability Management with ServiceNow VR Assignment Rules
- Snyk Helps Secure the Golang Bento Project
- AI Code Generation: Code Security & Quality, Benefits, Risks & Top Tools
- DevSecOps Automation Framework
- Learn about API security risks with the new Snyk Learn Learning Path
- Fetch the Flag CTF 2025 Community Writeups
- Can Snyk Detect JWT Security Issues?
February 2025
- Solving Security Challenges with Snyk Code and Symbolic AI
- Celebrating Black History Month 2025 at Snyk
- Incorporating security by design: Managing risk in DevSecOps
- Can Snyk Find Weak Cryptographic Algorithms? Bye Bye MD5
- Snyk’s Fetch the Flag CTF is More Than Just a CTF
- Do not pass GO - Malicious Package Alert
- Consolidate Security Findings with Snyk and Google Security Command Center
- Creating SBOMs with the Snyk CLI
- Best Practices for Creating a Modern npm Package with Security in Mind
January 2025
- Introducing Snyk Accelerate with Accenture
- Reviving DevSecOps: How Snyk’s new framework builds trust and collaboration
- The First Round of Changes to Match Snyk's Design Language
- Understanding the EU’s Cyber Resilience Act (CRA)
- Sneak Peek into Fetch the Flag CTF 2025
- BFI’s Journey in Digital Transformation: A Fireside Chat on Elevating Application Security and Developer Experience
- Snyk Security Labs Testing Update: Cursor.com AI Code Editor
- Snyk Recognized as Trusted Partner and Innovator by JPMorganChase
- Securing GenAI Development with Snyk
- 10 Docker Security Best Practices
- Securing the Digital Future: AppSec Best Practices in Digital Banking
- New Year, New Security Goals: Improve Your AppSec in 2025
2024 153
December 2024
- Did You Make the *Security* Naughty or Nice List This Year?
- 4 Tips for Securing GenAI-Assisted Development
- Snyk’s risk-based approach to prioritization
- Ultralytics AI Pwn Request Supply Chain Attack
- How to Mitigate SSRF Vulnerabilities in Go
- Snyk-Generated SBOMs Now Include License Details for the Open Source Libraries in Your Projects
- 2024 Open Source Security Report: Slowing Progress and New Challenges for DevSecOps
- Seven steps to close coverage gaps with ASPM
November 2024
- Empowering women in security: The impact of mentorship
- Why a solid DevOps foundation is vital for effective DevSecOps
- Measuring AppSec success: Key KPIs that demonstrate value
- A commitment to future generations: Snyk’s 2024 Student Edition Capture The Flag Recap
- How to prioritize vulnerabilities based on risk
- Women in security: Inspiring leaders of today and tomorrow
- Understanding command injection vulnerabilities in Go
- Snyk named a Customer Favorite in The Forrester Wave™: Software Composition Analysis Software, Q4 2024 Report
- How ASPM boosts visibility to manage application risk
- Extending developer security with dev-first dynamic testing
- If you don’t know about HTTP Archive’s Web Almanac yet, you should!
October 2024
- Lottie Player npm package compromised for crypto wallet theft
- Top 5 SAST Auto-fixing Tools and How They Compare
- Best practices for continuous vulnerability management
- Find, auto-fix, and prioritize intelligently, with Snyk's AI-powered code security tools
- Vulnerability-Free C and C++ development in automotive manufacturing and software defined vehicles (SDV)
- Women - Kickstart your Application Security Career!
- Elevating views of risk: Holistic application risk management with Snyk
- Introducing: Extensive AppSec visibility with Snyk Analytics
- Ensuring comprehensive security testing in DevOps pipelines
- Snyk announces commitment to Service for America, bringing security education access to all
- How Snyk is prioritizing developer experience
- Automatically fix code vulnerabilities with AI
- Analyze Taint Analysis Faster with Improved Contextual Dataflow in Snyk Code
- Foundations of trust: Securing the future of AI-generated code
- SnykLaunch Oct 2024: Enhanced PR experience, extended visibility, AI-powered security, holistic risk management
- The mysterious supply chain concern of string-width-cjs npm package
- Proactive AppSec continuous vulnerability management for developers and security teams
- Snyk named a 2024 Gartner Peer Insights™ Customers’ Choice for Application Security Testing for the 3rd consecutive year
- Going beyond reachability to prioritize what matters most
September 2024
- Zero-day RCE vulnerability found in CUPS - Common UNIX Printing System
- How to prevent log injection vulnerability in JavaScript and Node.js applications
- Promise queues and batching concurrent tasks in Deno
- Identifying insecure C Code with Valgrind and fixing with Snyk Code
- 3 best practices to make the most of Snyk AppRisk Essentials
- Dive into AI and LLM learning with the new Snyk Learn learning path
- Meet Snyk for Government: Our developer security solution with FedRAMP ATO
- Want to avoid a data breach? Employ secrets detection
- Announcing new Snyk AppRisk integration with Orca Security
- 5 reasons why developers at FinServ institutions are outpacing their security teammates
- What you should know about PHP code security
- How Axel Springer National Media and Tech achieved continuous security with Snyk
- 3 ways AppSec modernization is a game-changer for financial services
August 2024
- The persistent threat: Why major vulnerabilities like Log4Shell and Spring4Shell remain significant
- Snyk Code, the only security tool chosen by developers in Stack Overflow's 2024 AI Search and Developer Tools survey
- Navigating the AI-powered development era in financial services
- A developer’s best friend: Lessons learned from our canine companions about AI code security
- Three trends shaping software supply chain security today
- The journey to AppSec gold: Lessons we can learn from the Olympians
- InCyber Forum Europe recap: 4 tips from DevSecOps experts
- Vulnerabilities in NodeJS C/C++ add-on extensions
- Four easy ways to analyze your Java and Kotlin code
- A security expert’s view on Gartner’s generative AI insights - Part 2
- Application vulnerability management best practices
- Extend the power of your AppSec data with the new Snyk and Snowflake integration
- Infosec Europe session: 4 tips for safer AI adoption
- Introducing new Snyk AppRisk integrations: Enhancing application risk management with development context
July 2024
- A denial of service Regex breaks FastAPI security
- Preventing SQL injection in C# with Entity Framework
- Welcoming Diana Brunelle: Snyk’s New Chief People Officer
- How to setup Deno Dev Container on GitHub Codespaces?
- 10 Dimensions of Python Static Analysis
- How to secure an S3 bucket on AWS?
- A stepping stone towards holistic application risk and compliance management of the Digital Operational Resiliency Act (DORA)
- Going beyond “shift left” to extend AppSec in all directions
June 2024
- How to secure a REST API?
- Polyfill supply chain attack embeds malware in JavaScript CDN assets
- Finding and fixing exposed hardcoded secrets in your GitHub project with Snyk
- Snyk Code now secures AI builds with support for LLM sources
- Why ASPM is the future of AppSec: Key points from our newest whitepaper
- Automate security controls from development to production on Google Cloud
- Integrating the Snyk Language Server with IntelliJ IDEs
- 4 AI coding risks and how to address them
- Why “vulnerability management” falls short in modern application security
- Essential Node.js backend examples for developers in 2024
- Snyk and AWS announce native Amazon EKS support directly from the AWS Management Console
- AI quality: Garbage in, garbage out
- Talk to us about Snyk CLI
- Securing next-gen development: Lessons from Trust Bank and TASConnect
- Secure AI tool adoption: Perceptions and realities
- Snyk sponsors Snowflake Summit
May 2024
- 5 tips for adopting AI code assistance securely
- 10 modern Node.js runtime features to start using in 2024
- Fastify plugins as building blocks for a backend Node.js API
- Preventing broken access control in express Node.js applications
- Learning from cloud transformation as we move to AI
- How to secure Python Flask applications
- Symmetric vs. asymmetric encryption: Practical Python examples
- AppSec spring cleaning checklist
- Meet the new host for The Secure Developer podcast
- The ultimate guide to creating a secure Python package
- More accurate than GPT-4: How Snyk’s CodeReduce improved the performance of other LLMs
- Integrating Snyk Code SAST results in your ServiceNow workflows
- Snyk AppRisk Pro: A holistic approach to application risk management
April 2024
- Snyk CLI: Introducing Semantic Versioning and release channels
- How Mulesoft fosters a developer-first, shift-left culture with Snyk
- 360 degrees of application security with Snyk
- Snyk Code’s auto-fixing feature, Snyk Agent Fix, just got better
- DevOpsDays Singapore 2024: Unmasking the security pitfalls in AI-generated code
- Building an npm package compatible with ESM and CJS in 2024
- Day in the life of a food giant CISO
- How to install Java on macOS
- An investigation into code injection vulnerabilities caused by generative AI
- How SAS secures their AI-generated code
- Nine Docker pro tips for Node.js developers
- Six takeaways from our ASPM masterclass series
- Introducing Snyk’s partnership with Gemini Code Assist
- Exploiting HTTP/2 CONTINUATION frames for DoS attacks
March 2024
- The XZ backdoor CVE-2024-3094
- Securing your SBOM on Google Cloud
- How Snyk ensures safe adoption of AI
- Getting started with PHP static analysis in 2024
- Snyk's AppSec dream team
- Snyk users don't have to worry about NVD delays
- Introducing the ASPM Masterclass
- GitHub “besieged” by malware repositories and repo confusion: Why you'll be ok
- AppSec Maturity Models
- Snyk Learn and the NIST Cybersecurity Framework (CSF)
- 5 security best practices for adopting generative AI code assistants like GitHub Copilot
- Welcoming Gary Olson: Snyk’s new Chief Revenue Officer
- Essential AI Tools to Boost Developer Productivity and Security
February 2024
- Defense in Depth
- Snyk documentation: Our journey so far
- 5 Node.js security code snippets every backend developer should know
- How REI built a DevSecOps culture and how Snyk helped
- How to build a modern DevSecOps culture: Lessons from Jaguar Land Rover and Asda
- Preventing server-side request forgery in Node.js applications
- Preventing SQL injection attacks in Node.js
- Snyk & Atlassian: How to embed security in AI-assisted software development
- With Love, Your Applications
- Reporting AppSec risk up to your CISO
- Automatic source locations with Rego
- Welcoming Danny Allan and Brian Rogan: Snyk leadership team expands with key appointments to accelerate innovation
- 10 GitHub Security Best Practices
January 2024
- 7 tips to become a successful bug bounty hunter
- The 4 best DevSecOps tools for a secure DevOps workflow
- 3 tips from Snyk and Dynatrace’s AI security experts
- New Year's security resolutions for 2024 from Snyk DevRel, SecRel, and friends
- Understanding and mitigating the Jinja2 XSS vulnerability (CVE-2024-22195)
- Snyk welcomes Helios, accelerating our ASPM vision with runtime insights
- Mastering Python virtual environments: A complete guide to venv, Docker, and securing your code
- How to choose a security tool for your AI-generated code
- Build and deploy a Node.js security scanning API to Platformatic Cloud
- Krampus delivers an end-of-year Struts vulnerability
- Kroger’s approach to supply chain security
2023 259
December 2023
- 3 tips for rebuilding a Docker image faster (and save CI seconds!)
- How to prevent open redirect vulnerabilities in Laravel
- Command injection in Python: examples and prevention
- Is your team on the *security* naughty or nice list?
- Vulnerability disclosure: Which comes first, the security bug in PHP or the CVE?
- Common SAML vulnerabilities and how to remediate them
- Top 3 security best practices for handling JWTs
- Snyk named as a top cybersecurity company in inaugural Fortune Cyber 60 2023 list
- Enhancing code to cloud security with the Common Configuration Scoring System
- Snyk highlights AWS re:Invent 2023
- Announcing Snyk AppRisk: Elevate your AppSec game with ASPM
- Three reasons to invest in an ASPM solution in 2024
- Snyk recognized as an Emerging Segment Leader in Application Security in Snowflake's Next Generation of Cybersecurity Applications report
- Code injection in Python: examples and prevention
- Secure password hashing in Go
- Accelerate C/ C++ security with Snyk
- Snyk named a 2023 Gartner Peer Insights™ Customers’ Choice for Application Security Testing
- Achieving developer security adoption at Nylas with Snyk
November 2023
- Snyk Fetch the Flag CTF 2023 writeup: Off the SETUID
- Snyk Fetch the Flag CTF 2023 writeup: I Do Math
- Snyk Fetch the Flag CTF 2023 writeup: Honey Baked Messages
- Snyk Fetch the Flag CTF 2023 writeup: Protect The Environment
- Snyk Fetch the Flag CTF 2023 writeup: Silent Cartographer
- Snyk Fetch the Flag CTF 2023 writeup: Audiopolis
- Snyk is your security companion for Amazon CodeWhisperer
- Nightfall AI and Snyk unite to deliver AI-powered secrets scanning for developers
- Handling security vulnerabilities in Spring Boot
- 4 Advantages of using AI code review
- How to integrate ASPM with your application security program
- A DevSecOps solution for your apps on AWS from Snyk
- Exploring WebExtension security vulnerabilities in React Developer Tools and Vue.js devtools
- File encryption in Python: An in-depth exploration of symmetric and asymmetric techniques
- Our favorite 2023 Snyk Fetch the Flag CTF writeups from the community
- Improving the UI/UX of the Snyk VS Code extension
- Snyk Apps now GA: An easy, standardized, and secure framework for building custom integrations
- Vulnerability vs Weakness: Understanding Key Differences in AppSec
- Rego 103: Types of values and rules
- Snyk achieves AWS Security Competency
- Demystifying the AWS shared security responsibility model
- Real-time threat protection with Snyk and SentinelOne
- Rego 102: Combining queries with AND/OR and custom messages
- Snyk Week of Impact 2023: A week of meaningful contributions and community engagement
- What’s new in CVSS 4.0
- Secure your software supply chain with the new Snyk Vulnerability Intelligence for SBOM ServiceNow integration
- Security vs. Development: A game of priorities
- Asset-first application security: What is it and how can it help
- Rego 101: Introduction to Rego
- What does Biden's Executive Order on AI safety measures mean for businesses?
October 2023
- Dependency injection in Python
- Snyk welcomes Reviewpad: Code, commit, celebrate!
- The art of conditional rendering: Tips and tricks for React and Next.js developers
- Weak Hash vulnerability discovered in crypto-js and crypto-es (CVE-2023-46233 & CVE-2023-46133)
- Why You Need a Security Companion for AI-Generated Code
- Adding Snyk security to Jira and Bitbucket Cloud
- How to secure JavaScript applications right from the CLI
- Getting started with query parameterization
- How to keep an HTTP connection alive for 9 hours
- Power up security collaboration with Snyk and Slack
- Securing symmetric encryption algorithms in Java
- How to protect Node.js apps from CSRF attacks
- 6 steps for scaling risk-based AppSec programs
- Installing and managing Java on macOS
- Find and fix HTTP/2 rapid reset zero-day vulnerability CVE-2023-44487
- How to update cURL
- Cybersecurity Venture’s 2023 Software Supply Chain Attack Report
- SAS and Snyk discuss the future of AI for development and security teams
- How to find and fix Critical WebP zero-day vulnerability CVE-2023-4863
- Introducing the Snyk App for Compass: A complete view of software component risk
- High severity vulnerability found in libcurl and curl (CVE-2023-38545)
- Priorities from the OpenSSF Secure Open Source Software Summit 2023
- Snyk Partner Speak video series with HashiCorp
- Does AI lead to AppSec hell or nirvana?
- Announcing IaC+ early access: Secure your infrastructure configurations across the SDLC
- Modern VS Code extension development tutorial: Building a secure extension
September 2023
- Critical WebP 0-day security CVE-2023-4863 impacts wider software ecosystem
- 10 best practices for securely developing with AI
- Signing container images: Comparing Sigstore, Notary, and Docker Content Trust
- How to prevent NullPointerExceptions in Java
- Snyk is named a Strong Performer as a first-time entrant in the Forrester Wave™: Static Application Security Testing (SAST) Q3 2023
- Developer-first supply chain security
- Black Hat Asia customer panel recap: How to lead DevSecOps adoption
- Modern VS Code extension development: The basics
- An Introduction to capture the flag
- Security implications of cross-origin resource sharing (CORS) in Node.js
- A guide to input validation with Spring Boot
- How to avoid web cache poisoning attacks
- Top considerations for addressing risks in the OWASP Top 10 for LLMs
- Fetch the Flag CTF 2023 sneak peek
- Node.js vs. Deno vs. Bun: Performance & JavaScript Runtime Comparison
August 2023
- 7 AppSec tips from Snowflake’s Director of Product Security
- How to use AI for software development and cybersecurity
- How to implement SSL/TLS pinning in Node.js
- What kind of (security) dog are you?
- How Okta empowers devs to find & fix security issues with Snyk
- Using JLink to create smaller Docker images for your Spring Boot Java application
- Top 5 VS Code extensions for security
- Streamline dependency updates with Mergify and Snyk
- Best practices for building a production-ready Dockerfile for PHP applications
- Does GitOps enhance application security?
- Introducing Snyk’s new Risk Score for risk-based prioritization
- What are AI hallucinations and why should developers care?
- Secure Java URL encoding and decoding
- CodeSecDays conference and more complete security coverage with GitGuardian
- Manage security issues in Jira with Snyk Security in Jira Cloud
- .NET developers alert: Moq NuGET package exfiltrates user emails from git
- Snyk Ranked #19 on 2023 Forbes Cloud 100 List
- 5 tips to supercharge app security from code to cloud
- Mitigating DOM clobbering attacks in JavaScript
- Limitations of a single AI model
- New SEC cybersecurity rules put more onus on the CISO, not so much on directors
- Discussions on improving security through chaos engineering
- Software Supply Chain Security Tools: Types, Features & Considerations
- How to Dockerize a PHP application securely
- How Snyk can help secure supply chains per "A Guide to Implementing the Software Bill of Materials (SBOM) for Software Management"’ by Japan's METI
July 2023
- Implementing TLS in Kubernetes
- How secure is WebAssembly? 5 security concerns unique to WebAssembly
- Control your role! Kubernetes RBAC explored
- Snyk's 2023 State of Open Source Security: Supply chain security, AI, and more
- 4 Enterprise-level security best practices
- 8 tips for securing your CI/CD pipeline with Snyk
- Best practices for using AI in the SDLC
- Finding and fixing insecure direct object references in Python
- Swift deserialization security primer
- Best practices for effective attack surface analysis
- XS leaks: What they are and how to avoid them
- Top 5 security concerns for infrastructure as code
- How to strengthen security in your CI/CD pipeline
- Session management security: Best practices for protecting user sessions
June 2023
- Building a security-conscious CI/CD pipeline
- The importance of verifying webhook signatures
- Using insecure npm package manager defaults to steal your macOS keyboard shortcuts
- Mimic your mental model with Project Collections
- Maximizing IAM security with AWS permissions boundaries and Snyk
- Secrets Management: Tools & Best Practice
- Research with Snyk and Redhunt Labs: Scanning the top 1000 orgs on GitHub
- How to implement DevSecOps in 4 steps: DevSecOps implementation strategy
- SnakeYaml 2.0: Solving the unsafe deserialization vulnerability
- Patches of Pride: Love, inclusivity, & cute pets in celebration of Pride month
- Understanding Kubernetes Pod Security Standards
- Celebrating Juneteenth at Snyk
- The SecurityManager is getting removed in Java: What that means for you
- The Secure Developer: Security champions recap
- Snyk named a Leader, placed highest in Strategy category in The Forrester Wave: Software Composition Analysis (SCA), Q2 2023 report
- Snyk integrates with Amazon EventBridge to enable secure AppDev at scale
- Snyk integrates with AWS Security Hub to automate security remediation workflows
- Snyk Partner Speaks series: True DevSecOps with Snyk and Dynatrace
- Snyk welcomes Enso: Enabling security leaders to scale their AppSec program with ASPM
- Snyk Learn now aligns with the NIST NICE Workforce Framework
- Reduce risk to your supply chain with a software bill of materials (SBOM)
- Announcing Insights: Helping you focus on top risks for your organization
- SnykLaunch June ‘23: Insights and DeepCode AI enable faster fixes and prioritization
- What can you do with an enriched SBOM? A parlay quickstart guide
- Introducing parlay, a tool for enriching SBOMs
- High profile AWS breaches & how to avoid them
- Snyk scanning capabilities are now embedded in Jira Software
- A day in the life of an ethical hacker
- Ethical hacking techniques
- Ethical Hacking: Top Tools
- A quick primer on LDAP injection
May 2023
- Snyk announces new Slack integration
- Snykers share wellness tips for mental health awareness month
- Amplifying AAPI Voices to Honor Asian American Pacific Islander Heritage Month
- Top 8 penetration testing tools
- Data loss prevention for developers
- Snyk named a Leader in 2023 Gartner® Magic Quadrant™ for Application Security Testing
- Improved risk assessment with EPSS scores in Snyk
- How to generate an SBOM for JavaScript and Node.js applications
- Setting up the Docker image scan GitHub Action
- Snyk top 10 code vulnerabilities report
- Snyk Recharge days: Making time to take time
- Security success in the Bay Area with Slack
- Snyk Learn and NYU partner up to boost your developer security skills
- Snyk and ServiceNow collaborate on new SBOM solution
- DevSecOps lifecycle coverage with new Snyk and Dynatrace app
- How to prevent XPath injection attacks
- AI-generated security fixes in Snyk Code now available
- Snyk named to CNBC 2023 Disruptor 50 List
- Secure JavaScript URL validation
- Engineering culture at Snyk: The values that support and drive our teams
- Snyk in a galaxy far away
- Fixing half a million security vulnerabilities
- Three considerations for building an effective security program
- Can AI write secure code?
- Security implications of HTTP response headers
- Snyk Partner Speak Video with ServiceNow: A complete view of application security
- How to perform JavaBeans Validation
April 2023
- Lessons from OpenSSL vulnerabilities part 2: Finding and fixing supply chain vulnerabilities
- Unlocking the power of multi-cloud security
- API Security Guide
- Preventing Cross-Site Scripting (XSS) in Java applications with Snyk Code
- Welcoming Beth Shea: Snyk’s new Chief Customer Officer
- 4 best practices for cultivating developer security adoption
- Lessons from OpenSSL vulnerabilities part 1: Preparing your supply chain for the next critical vulnerability
- Preventing insecure deserialization in Node.js
- Developer-centric DAST with Bright Security
- Snyk’s Evolution: A Message From CEO Peter McKay
- The importance of platform engineers in a security program
- Snyk Partner Speak Video Series Puts Spotlight on New Integrations
- Identify vulnerabilities in your container images with Snyk’s enhanced Docker Desktop Extension
- 5 ways to improve security during digital transformation
- New IaC security workshop from Snyk, HashiCorp, and AWS at KubeCon Europe 2023 and on-demand
- Timing out synchronous functions with regex
- Supply Chain Security Risks & Best Practice
- Fix cloud security issues faster and at the source with Snyk IaC
- SnykLaunch recap: Custom Base Image Recommendations
- How Snyk uses AI in developer security
- Snyk brings developer-first AppSec approach to C/C++
- SnykLaunch April '23: C/C++ expansion, cloud and IaC updates, custom container security, new integrations, and more
- Recap: Stress-Free Security for Devs and Ops on AWS
- Snyk achieves Red Hat Vulnerability Scanner Certification
- Introducing the Snyk Partner Solutions Directory for discovering Snyk technology integrations
- The Snyk Perpetual Key Rotation Machine
March 2023
- Data leak in the Netherlands: What developers should learn from this
- AWS in 30 recap
- Avoiding mass assignment vulnerabilities in Node.js
- Securing the web (forward)
- The rising trend of malicious packages in open source ecosystems
- PulseMeter Report: Software supply chains
- Securing the digital future: Reviewing the Biden-Harris administration's National Cybersecurity Strategy
- The Docker project turns 10! Looking back at a decade of containers
- New language-specific Snyk Top 10 for open source vulnerabilities
- AWS top 10 misconfigurations and how to fix them: A cheat sheet
- Preventing XSS in Django
- CISO playbook: 3 things to consider when establishing a security culture
- Comparing Node.js web frameworks: Which is most secure?
- Mitigating path traversal vulns in Java with Snyk Code
- Snyk in 30: Developer-first security democast
- Top AWS Security Risks & Prevention
- Cybersecurity Hygiene 101
- Three expert tips for cultivating secure software development practices
February 2023
- API authentication vulnerability found in Snyk Kubernetes integration (CVE-2023-1065)
- Node.js multithreading with worker threads: pros and cons
- Finding YAML Deserialization with Snyk Code
- The security concerns of a JavaScript sandbox with the Node.js VM module
- Embrace your next cybersecurity career with The Big Fix
- Building Vue 3 components with Tailwind CSS
- My internship journey at Snyk
- Snyk sponsors Dynatrace Perform 2023 with a preview of new integration
- When software isn’t a “supply”
- The dangers of setattr: Avoiding Mass Assignment vulnerabilities in Python
- Announcing The Big Fix: Secure all software
- CSPRNG: Random algorithms need security too!
- Snyk and Atlassian deepen partnership with Snyk security in Jira Software
- Evolving the Snyk CLI through an extensible approach
- Automate cloud compliance with Snyk IaC
- 4 application security bad habits to ditch in 2023 (and best practices to adopt instead)
January 2023
- Advanced IntelliJ debugger features you’re missing out on
- Using Python libraries for secure network communication
- Adding security to Nuxt 3
- Snyk enhances ServiceNow with comprehensive insights into vulnerabilities in open source software
- Prevent OWASP Top 10 vulns with new Snyk Learn learning path
- New year ushers in new wave of Snyk Technology Alliance Partner Program members
- Three ways Snyk made software supply chains more secure in 2022
- OSPO security evolution: The Kübler-Ross Model of open source
- Snyk transformed cloud security in 2022 with developer-first solution
- Snyk's AppSec journey in 2022
- Bolstering Snyk's developer security platform in 2022
- Supply chain security incident at CircleCI: Rotate your secrets
- Creating AWS security efficiencies in IT
2022 309
December 2022
- You should be using HTTP Strict Transport Security (HSTS) headers in your Node.js server
- How to build a secure API gateway in Node.js
- 5 "no experience needed" tips for building secure applications
- Cloud security updates you need to know from re:Invent 2022
- Kubernetes network policy best practices
- Panel recap: Breaking Bad Security Habits with Corey Quinn
- Building an application security battle plan: Home Alone edition
- Cloud Security Podcast awarded SANS Podcast of the Year
- Exploring the Spring Security authorization bypass (CVE-2022-31692)
- Snyk in 30: Open source security for Atlassian Bitbucket Cloud
- Top takeaways from re:Invent 2022
- Unsafe deserialization vulnerability in SnakeYaml (CVE-2022-1471)
- Azure Bicep security fundamentals
- AWS re:Invent 2022: How Neiman Marcus transitioned to developer-first security
- Using Snyk reporting for data-driven security
- How to handle Node.js file uploads with Fastify
- 5 best practices for React with TypeScript security
- Why tool consolidation matters for developer security
- How to verify and secure your Mastodon account
- 3 tips for effective developer security training
November 2022
- Code injection vulnerabilities (CVSSv3 5.8) found in Snyk CLI and IDE plugins
- Snyk expands in Asia-Pacific (APAC) with new datacenter in Sydney, Australia
- 10 AWS security considerations when migrating
- Can gamification unite development and security?
- How to use GitHub Actions environment variables
- How to write tests in Python using doctest
- Writing unit tests in Java
- Setting up SSL/TLS for Kubernetes Ingress
- Dependency injection in JavaScript
- Best practices for Kubernetes Secrets management
- How Atlassian used Snyk to solve Log4Shell
- How community participation can enhance your development career
- 5 best practices for building modern access control for cloud applications
- Snyk's ultimate AWS re:Invent 2022 survival guide
- Fetch the Flag CTF 2022 writeup: Potty Training
- Cloud security fundamentals part 5: Measure what matters
- Fetch the Flag CTF 2022 writeup: Disposable Message
- Fetch the Flag CTF 2022 writeup: git-refs
- Fetch the Flag CTF 2022 writeup: Not So Smart Fridge
- Fetch the Flag CTF 2022 writeup: Roadrunner
- Fetch the Flag CTF 2022 writeup: Logster
- Fetch the Flag CTF 2022 writeup: Juggalo Central
- Fetch the Flag CTF 2022 writeup: Treasure Trove
- Fetch the Flag CTF 2022 writeup: Pay Attention
- Fetch the Flag CTF 2022 writeup: Moongoose
- Implementing TLS in Java
- Announcing the open beta of Snyk's revamped security reporting
- Fetch the Flag CTF 2022 writeup: File Explorer
- Fetch the Flag CTF 2022 writeup: Containers are ACE
- SnykLaunch recap: Snyk Cloud, SBOM & reporting capabilities, and customer solutions resources
- NPM security: preventing supply chain attacks
- Key points from Google and Accenture's ransomware white paper
- A day in the life of a CISO: Chris Hughes of Aquia
- Secure Python URL validation
- Cloud security fundamentals part 4: Align and automate with policy as code
- Update: OpenSSL high severity vulnerabilities
- Ruby on Rails Docker for local development environment
- Scaling your security team without hiring
October 2022
- How to create SBOMs in Java with Maven and Gradle
- Top 5 scary AWS misconfigurations
- Top 5 Docker Security Vulnerabilities
- New OpenSSL critical vulnerability: What you need to know
- Why fuzzing tools should be part of your security toolkit
- How to write your first unit test in JavaScript
- Understanding DNS attacks: Identifying and patching vulnerabilities
- Node.js multithreading with worker threads series: worker_threads tutorial
- Snyk’s new native integration with Bitbucket Cloud emphasizes dev-first security
- A Message from Snyk CEO Peter McKay
- How to send Snyk vulnerability data to the New Relic observability platform
- Cloud security fundamentals part 3: Empower your developers
- How to make a mock API server in JavaScript
- SREs bring ORDER(R) to CHAOS
- Reviewing CVE-2022-42889: The arbitrary code execution vulnerability in Apache Commons Text
- 2022 Snyk Customer Value Study highlights: The impact of developer-first security
- Top 8 AWS Security Best Practices
- How to contribute to open source projects
- Implementing TLS/SSL in Python
- How to add Playwright tests to your pull request CI with GitHub Actions
- Cloud security fundamentals part 2: Prevention and secure design
- Ruby email rule removed from Snyk Code
- Secure your application from Argo CD to Kubernetes
- Improving code quality with linting in Python
- How to use Java DTOs to stay secure
- Security lessons with a Snyk Ambassador
- SnykWeek New York: In the cloud
- Container images simplified with Ko
- Red teams vs blue teams: Breaking down security roles
- Cloud security fundamentals part 1: Know your environment
- Proxy authentication in Snyk CLI for Windows
- Snyk + International Dog Day: recap
- 2022 Collaboration Partner of the Year: Snyk
- Snyk named a 2022 Gartner Peer Insights Customers’ Choice for Application Security Testing
- Command injection vulnerability in Snyk CLI released prior to September 1, 2022 (older than v1.996.0)
September 2022
- Why developers hold the key to cloud security
- Choosing the best Node.js Docker image
- Introducing the new Snyk UI
- Snyk IaC for Terraform Enterprise: Expanding Snyk compatibility with HashiCorp Terraform
- Snyk & 01Founders partner to diversify tech
- How to install Ruby in a macOS for local development
- Top 8 DevSecOps Best Practices - Build Securely
- 7 Best practices for disaster recovery testing
- OWASP API Security Top 10 Risks
- 5 Disaster Recovery Testing Methodologies
- Looking back at Black Hat USA 2022
- Meet (and join) our newest Snyk Ambassadors – Fall 2022 edition!
- Cheat sheet: Meeting security compliance standards
- 10 best practices to containerize Node.js web applications with Docker
- Avoiding SMTP Injection: A Whitebox primer
- How Spotify uses Snyk to secure the SDLC
- Announcing the 2022 State of Cloud Security report from Snyk
- How Onna Technologies uses Snyk & Sysdig to secure the SDLC while saving time and money
- Using Kubernetes ConfigMaps securely
- Integrating Snyk Open Source C/C++ security scanning into CI pipelines
- Best practices for API gateway security
- How to find and fix XML entity vulnerabilities
- Snyk Security using Language Server Protocol
- Cloud Security at Blackhat and Defcon 2022
- Response to the Enduring Security Framework (ESF) Guide for Developers
- The npm faker package and the unexpected demise of open source libraries
- Solve Hack the Box and other CTF challenges with Snyk
August 2022
- Best practices for containerizing .net applications
- How to build a Slack bot with Zapier and JavaScript to fetch trending topics on Reddit
- Securing container applications using the Snyk CLI
- Best practices for container isolation
- Applying the principle of least privilege to Kubernetes using RBAC
- Best practices for managing Java dependencies
- Building a secure API with gRPC
- Keeping Docker secrets secure (even if you’re not using Kubernetes)
- 8 tips for securing containers from source to runtime
- 10 best practices to build a Java container with Docker
- Rediscovering argument injection when using VCS tools — git and mercurial
- 5 ways to secure Drupal 10
- How open source C++ code can introduce security risks
- Celebrate International Dog Day with #DevelopersBestFriend
- The dangers of assert in Python
- Ruby gem installations can expose you to lockfile injection attacks
- Top 5 C++ security risks
- Installing multiple Snyk Kubernetes controllers into a single Kubernetes cluster
- Python Code Review Tools
- Introducing Snyk Training, our online learning platform
- Controlling your server with a reverse shell attack
- Snyk ranked #20 on 2022 Forbes Cloud 100 list
- AWS re:Inforce 2022 recap
- A definitive guide to Ruby gems dependency management
- Securing PHP containers
- Slidev 101: Coding presentations with Markdown
- Testing effectively in Terraform
- Join the Snyk Developer Challenge
- Welcoming Manoj Nair: Snyk’s New Chief Product Officer
July 2022
- Buffer overflow attacks in C++: A hands-on guide
- Allyship and advocacy: Celebrating Disability Pride Month at Snyk
- The Cloud Security Podcast is now powered by Snyk!
- Best practices for your first 30 days with Snyk
- Webinar recap: Snyk and the new era of software security
- Addressing cybersecurity challenges in open source software with the Linux Foundation
- Top 5 tips for C++ security
- Webinar recap: The missing story with every cloud breach
- 5 Best Practices for Container security
- 10 React security best practices
- Improving developer experience with security tools at Pinterest
- The security course missing from higher education
- Exploring CVE-2022-33980: the Apache Commons configuration RCE vulnerability
- Webhook Security Best Practices
- How to build a secure WebSocket server in Python
June 2022
- Announcing organizational updates to better serve our customers
- Reflecting on Pride Month 2022 at Snyk
- Announcing customized role-based access controls for Snyk
- Snyk is now also hosted in the EU providing regional data residency
- Snyk’s response to the U.S. Supreme Court overturning Roe v. Wade
- Building a secure CI/CD pipeline with GitHub Actions for your Java Application
- Developer empowerment for software security with Snyk IDE plugins
- Safely handling containers
- Announcing the 2022 State of Open Source Security report from Snyk and the Linux Foundation
- Celebrating Father’s Day at Snyk
- Juneteenth: Momentum. Memory. Movement.
- Snyk’s guide to disclosing pronouns
- Bringing cloud native application security full circle
- 6 Kubernetes Tools That Can Help Secure Containers at Runtime
- Safer together: Snyk and CISPA collaborate for the greater good
- Using Rego as a generic policy language
May 2022
- Mental Health Awareness Month: How losing my father changed me
- Celebrating Asian American and Pacific Islander Heritage Month
- SnykWeek Boston: Perspectives on developer security adoption
- Snyk finds 200+ malicious npm packages, including Cobalt Strike dependency confusion attacks
- Snyk takes over Boston for SnykWeek
- How LiveRamp used Snyk to remediate Log4Shell
- Cloud security challenges
- Interview with an engineer: Diving into modern SAST
- The importance of security automation
- SDR Series: Meet our EMEA team
- Welcoming Adi Sharabani: Snyk’s new Chief Technology Officer
- Detect infrastructure drift and unmanaged resources with Snyk IaC
- Congratulations to Snyk’s 2022 CRN Women of the Channel
- Happy 1st Birthday, Snyk Code!
- Snyk Voices: Returning from maternity leave
- SurveyMonkey talks with Snyk about developer security during hypergrowth
- SDR Series: Meet our North America team
- Snyk brings infrastructure as code security to HashiCorp Terraform Cloud
- These aren’t the npm packages you’re looking for
- 3 Jedi-inspired lessons to level up your JavaScript security
- May the 4th be with your video
- Ignoring vulnerabilities with Snyk
- Building Docker images in Kubernetes
- Snyk and StackHawk form strategic alliance to equip app teams with modern, developer-first security testing
April 2022
- Targeted npm dependency confusion attack caught red-handed
- C++ in the wild: Which industries use C++?
- Under the C: A glance at C/C++ vulnerabilities in Python land
- 2022 Container Security Trends Report: Exploring ownership, education, expertise, and more
- Snyk increases investment in partners with new Snyk Technology Alliance Partner Program
- 6 Software Composition Analysis (SCA) best practices
- SDR Series: Meet our APJ team
- 6 tips for managing your open source components
- Generating fake security data with Python and faker-security
- Why you need a Kubernetes admission controller
- WillowTree roundtable: security for hypergrowth organizations
- Investing in our planet: One tree planted for each new Snyker
- 5 tips for securing PHP Laravel
- The ultimate guide to Python pickle
- Modernizing SAST rules maintenance to catch vulnerabilities faster
- An unintimidating introduction to the dark arts of C/C++ vulnerabilities
- SnykCon recap: Automation for better compliance and faster feedback loops
- Improving GraphQL security with static analysis and Snyk Code
- Spring4Shell extends to Glassfish and Payara: same vulnerability, new exploit
- Getting started with React Native security
- Make Snyk notifications work for you
- Snyk Open Source adds C/C++ security scanning for unmanaged dependencies
- Snyk sponsors Atlassian Team ’22: Bringing developer security to the Atlassian ecosystem
- Exploring 3 types of directory traversal vulnerabilities in C/C++
- Introducing SUS: Snyk Ultimate Security
- Browsers tormented by open roll vulnerability
- Alert: LaughTilYouCry ransomware sabotages npm package (with puns)
- Spring4Shell: The zero-day RCE in the Spring Framework explained
March 2022
- Daughter + Dad: Coming out as transgender
- Spring4Shell: What we know about the Java RCE vulnerability
- Using the Snyk Vulnerability Database to find projects for The Big Fix
- Building a secure GraphQL API with Node.js
- Meet (and join) our newest Snyk Ambassadors!
- How to do password hashing in Java applications the right way!
- How Snyk helps satisfy White House cybersecurity recommendations
- Improving coverage of cloud resources to reduce infrastructure drift
- Best practices for containerizing Go applications with Docker
- Protestware is trending in open source: 4 different types and their impact
- dompdf security alert: RCE vulnerability found in popular PHP PDF library
- Alert: peacenotwar module sabotages npm developers in the node-ipc package to protest the invasion of Ukraine
- Snyk ceases business in Russia and Belarus
- Tools for infrastructure drift detection
- Build a software bill of materials (SBOM) for open source supply chain security
- "Dirty Pipe" Linux vulnerability and your containerized applications (CVE-2022-0847)
- Infrastructure drift and drift detection explained
- Hiring a virtual CISO to help your security team
- Celebrating amazing open source innovation from Ukraine
- Simplifying container security with Snyk’s security expertise
- SnykHer celebrates International Women’s Day 2022
- Welcoming TopCoat to Snyk
- Adding Container and IaC security to the Snyk plugin for Jetbrains
- Snyk and Bitbucket best practices cheat sheet
- Securing cloud infrastructure for PCI review
- Introduction to penetration testing for developers
- The Importance of Container Monitoring
- DevSecCon panel discussion: Which comes first, security or the app?
February 2022
- Visibly invisible malicious Node.js packages: When configuration niche meets invisible characters
- Snyk doubles free user limits and provides Snyk Impact donation in response to Ukrainian crisis
- Black@Snyk: Celebrating Black History Month 2022
- Magento security requires additional patch to fix sanitization vulnerability
- Announcing Snyk’s new Global Service Provider program
- Even non-developers can fix security vulnerabilities in code at The Big Fix
- Join The Big Fix: a 24-hour livestream dedicated to fixing security vulnerabilities in your projects
- A developer-centric approach to software
- CVE-2022-24086 Vulnerability alert for websites using Magento Ecommerce
- Welcoming Fugue as we build the future of developer-first cloud security
- Using the Snyk Vulnerability database to identify projects for The Big Fix
- Teaming up with Sysdig to deliver developer and runtime Kubernetes security
- Case study: Python RCE vulnerability in Celery
- Security implications of Kubernetes operators
- Automating Terraform security in Scalr deployments with Regula [Tutorial]
- SAST and SCA: Better together with Snyk
- Lessons learned from the Argo CD zero-day vulnerability (CVE-2022-24348)
- Microservices security: 6 best practice tips
- Join "The Big Fix" to secure your projects with Snyk and earn cool swag
- Using Pulumi to automate the Snyk Kubernetes integration for containers
- Enhancing PCI compliance security with SAST and SCA
- Welcoming Karyn Smith: Snyk’s new Chief Legal Officer
- Log4Shell remediation with Snyk by the numbers
- Enterprise security: Digital transformation and risk management with Anheuser-Busch Inbev and Manulife
- Fun with ciphers in copycat Wordles
- Snyk’s shift left approach to API development
January 2022
- Analyzing the PwnKit local privilege escalation exploit
- SnykCon recap: Building a developer-focused AppSec program
- Getting started at a new organization
- PHP security in Snyk Code now GA
- Stranger Danger: Live hack of how a Log4Shell exploit works
- Welcoming Kathleen Murphy and Zach Nelson to the Snyk Board of Directors
- How Lunar shifted security left while building a cloud native bank
- Enabling policy as code (PaC) with OPA and Rego
- Snyk Code scanning added to the Snyk Visual Studio extension
- 10 SDLC best practices to implement today
- 8 best Java code review tools for developers
- 8 proven code review best practices for developers
- New years resolution: Don’t show my security tokens when hacking my demo application on stage
- The Secure Developer: 2021 in review
- URL confusion vulnerabilities in the wild: Exploring parser inconsistencies
- Welcoming Samantha Wessels: Snyk’s New Vice President, EMEA Sales
- Open source maintainer pulls the plug on npm packages colors and faker, now what?
- FTC highlights the importance of securing Log4j and software supply chain
- Kicking off 2022 by recognizing DevSecOps leaders
- CTF secrets revealed: TopLang challenge from SnykCon 2021 explained
- Developer security resolutions for 2022
- Log4Shell webinar: What you need to know
- Securing a DevOps pipeline with Snyk, Bitbucket, and AWS
2021 226
December 2021
- Checking Terraform IaC security in CI/CD with Regula and Bitbucket Pipelines [Tutorial]
- New Log4j 2.17.1 fixes CVE-2021-44832 remote code execution (but it’s not as bad as it sounds)
- It takes a community: Responding to open source criticism post-Log4Shell
- Snyk IaC in 2021: Leading infrastructure as code security for developers
- Snyk Container in 2021: Shifting container security all the way left
- Snyk Code in 2021: Redefining SAST
- Snyk Open Source in 2021: A year of innovation
- Snyk makes it easier to fix Log4Shell with extended free scans
- Why you should implement an automated code review process
- Log4j 2.16 High Severity Vulnerability (CVE-2021-45105) Discovered
- Find Log4Shell vulnerabilities in your unmanaged and shaded jars with the Snyk CLI
- Log4j 2.15 vulnerability CVE-2021-45046 upgraded to a critical severity arbitrary code execution
- Security in context: When is a CVE not a CVE?
- Log4Shell in a nutshell (for non-developers & non-Java developers)
- Log4Shell remediation cheat sheet
- Build securely with Snyk and GKE Autopilot
- The Log4j vulnerability and its impact on software supply chain security
- Find and fix the Log4Shell exploit fast with Snyk
- Log4j vulnerability explained: Prevent Log4Shell RCE by updating to version 2.17.1
- Find and fix vulnerabilities in your CI/CD pipeline with Snyk and Harness
- Responsible disclosure: CodeCov CEO & CTO share learnings from the breach
- Snyk Open Source adds beta C/C++ security scanning for unmanaged OSS
- Java JSON deserialization problems with the Jackson ObjectMapper
November 2021
- Snyk achieves AWS Security Competency status
- Securing your open source dependencies with the Snyk Visual Studio Code extension
- Snyk Career Stories: Starting and growing your career through the Snyk SDR program
- Developing custom IaC rules with Snyk
- How to prevent Trojan Source attacks with Snyk Code
- Announcing automated fixes for vulnerabilities in .NET dependencies
- Proactively fixing vulnerabilities to maintain Java security and project hygiene with Snyk
- AppSec during hypergrowth: Empower your developers to overcome the tech talent shortage
- Best practices for containerizing Python applications with Docker
- Scanning ARM templates for misconfigurations with the Snyk CLI
- Snyk IaC wins 2021 CRN Tech Innovator Award & continues to grow channel business
- How to effectively detect and mitigate Trojan Source attacks in JavaScript codebases with ESLint
- How Snyk Code prioritizes vulnerabilities using their Priority Score
- How Datto made developer-first security a reality with Snyk
- 6 big AWS IAM vulnerabilities – and how to avoid them
- Exploring extensions of dependency confusion attacks via npm package aliasing
- Lessons learned from improving full-text search at Snyk with Elasticsearch
- How and when to use Docker labels / OCI container annotations
- JavaScript type confusion: Bypassed input validation (and how to remediate)
- How MongoDB built a successful security champions program
- What are security misconfigurations and how can you prevent them?
October 2021
- Accelerating the Snyk infrastructure as code vision with the addition of CloudSkiff
- Snyk Code adds language support for Apex, API, GraphQL security
- Providing Comprehensive Application Security from Code to Production: New Snyk and Hdiv Security Partnership
- Security Horror Story: Accidentally exposing PII data
- New Java 17 features for improved security and serialization
- Mapping vulnerabilities to microservices with Snyk and OpsLevel
- Exploring the advanced technologies behind Snyk Code
- Welcoming Sanjay Poonen to the Snyk Board of Directors
- Snyk joins OpenSSF: Tackling open source supply chain security with a developer-first approach
- Securing S3 bucket configuration and access with Snyk & Solvo
- How Dun & Bradstreet and Shutterstock built successful security champions programs
- Snyk Code adds Go security scanning
- Why the Facebook outage and Twitch breach matter to business leaders
- Welcoming Dino DiMarino: The first Snyk Chief Revenue Officer
- Securing a Kubernetes pod with Regula and Open Policy Agent
- Finding my voice: Reflecting on Hispanic Heritage Month
- SnykCon 2021 Partner Day recap: New partners, service offerings, and Snyk Apps
- SnykCon 2021 recap #2: Supply chain security, the future of cybersecurity, automation as an enabler, and more
- Snyk fix: Automatic vulnerability remediation from the Snyk CLI
- Checking AWS AMI IDs in Terraform using Regula and Open Policy Agent
- SnykCon 2021 recap #1: Snyk Learn, Snyk Apps, developer security, people hacking, security champions, and more
- Introducing Snyk Learn: Free developer security education
- Announcing Snyk Impact
- Introducing Snyk developer-first security into the Terraform Cloud workflow
- Announcing Snyk Apps beta: Build custom apps to extend Snyk security into your workflows
- Snyk 6th Birthday + NFT gifts!
- Join Snyk in celebrating 31 days of Cybersecurity Awareness Month 2021
September 2021
- Improve security by knowing when to ignore IaC vulnerabilities
- Call for nominations: The Snykie awards for Secure Development
- Python security best practices cheat sheet
- Snyk Container registry security integrations extended to GitHub, GitLab, Nexus, DigitalOcean, and more
- Snyk Code CLI support now in public beta
- Snyk sponsoring 2021 Open Source Summit by the Linux Foundation
- Introducing the new Snyk Docs Portal and Support Portal
- A (soft) introduction to Python dependency management
- Detect and prevent dependency confusion attacks on npm to maintain supply chain security
- The inevitability of Developer Security
- One month to SnykCon 2021: Sessions to attend, flags to capture, Simons to Maple
- 7 steps to improve developer security
- Snyk Code support for PHP vulnerability scanning enters beta
- Welcoming Adriana Bokel Herde: Snyk’s new Chief People Officer
August 2021
- Preventing malicious packages and supply chain attacks with Snyk
- 5 application security assessment steps
- Operating security ownership at scale: Twilio’s perspective
- The key to solving the cybersecurity workforce gap: Enlisting the world’s 27 million developers in the fight
- The 8 best IntelliJ plugins for improving your coding experience
- Hypergrowth Playbook: 7 best practices as you go from startup to scaleup
- Snyk Container meets Cloud Native Buildpacks: Cloud Native Application Security the right way
- SnykCon 2021 is almost here!
- Plugins to put Node.js application security and observability in your IDE
- Why speed matters in Static Application Security Testing (SAST)
- How Snyk Social Trends help you fix essential security vulnerabilities
- Building Java container images using Jib
- Introducing the Snyk Ambassador program: A call for nomination to champion application security
- Speed up container fixes with Snyk’s new automated parent image detection
- Use Snyk security policies to prioritize fixes more efficiently
- Snyk named #39 on 2021 Forbes Cloud 100 list
- Better Ruby Gemfile security: A step-by-step guide using Snyk
- How to publish Node.js Docker images to Docker Hub registry using GitHub Actions
- Championing diversity, equality, inclusion, and belonging at DevSecCon and Snyk
- Getting started with Snyk for secure Python development
- 3 parameters to measure SAST testing
- Brian Vermeer named one of Business Insider’s "21 Top Developers Shaping Tech and Forging New Paths"
- The best security advice from 100 episodes of The Secure Developer podcast
July 2021
- Snyk Code adds security scanning for C# and .NET
- Announcing Social Trends: Use social media for security intelligence
- Welcoming Tamar Yehoshua to the Snyk Board of Directors
- SAST tools speed comparison: Snyk Code vs SonarQube and LGTM
- Four steps for hardening Amazon EKS security
- How Snyk is normalizing authentication strategies with Gloo Edge
- Why you should upgrade to Maven version 3.8.1
- Devoxx4Kids: Empowering young Java developers and creating future industry stars
- Tips for hardening your container image security strategy
- Managing Node.js Docker images in GitHub Packages using GitHub Actions
- SnykCon 2021 excitement is starting, but the CFP is ending (soon)
- Hardening Amazon EKS security with RBAC, secure IMDS, and audit logging
- Tips and best practices for building secure container images
- Looking back at Pride Month 2021 here at Snyk!
- Talking visibility, scalability, and relationships in secure development with Phil Guimond of ViacomCBS
June 2021
- Snyk at RSAC 2021 — ML in SAST: Distraction or Disruption
- Snyker Spotlight: What I’ve learned from my career change
- 5 ways to prevent PHP code injection
- 5 potential risks of open source software
- 5 cloud application security best practices
- Snyker Spotlight: Proud of the home I found at Snyk
- Getting started with Snyk for secure Java development
- SnykCon 2021: 5 reasons to submit your talk
- Snyk Container is now an extension in the AWS CloudFormation Registry
- Scan for AWS CloudFormation misconfigurations with Snyk IaC
- Snyker Spotlight: Reflecting on Juneteenth
- You can’t compare SAST tools using only lists, test suites, and benchmarks
- Advancing SBOM standards: Snyk and SPDX
- New O’Reilly book — Cloud Native Application Security: Embracing Developer-First Security for the Cloud Era
- Snyk provides native integration for Atlassian Bitbucket Cloud security
- Easily map Snyk vulnerabilities to Cortex services
- Understanding the software supply chain security requirements in the cybersecurity Executive Order
- Secure development in Visual Studio with Snyk Open Source
- Automate vulnerability scanning in AWS CodePipeline with Snyk
- DevSecCon24 2021: 24 hours of development, security, and inclusivity
- Give employees the flexibility to do their best work
- Python now fully supported in Snyk Code
- Snyk named Visionary in 2021 Gartner Magic Quadrant for AST
- Announcing SnykCon 2021: Build Securely
May 2021
- Snyk debuts on 2021 CNBC Disruptor 50 List at #15
- Snyk uncovers supply chain security vulnerabilities in Visual Studio Code extensions
- Snyk takes on responsibility for Node.js ecosystem vulnerability disclosure program
- Continuous dependency updates: Improving processes by front-loading pain
- Introducing Snyk Preview: Early access to Snyk features
- Testing for PHP Composer security vulnerabilities with Snyk
- Snyker Spotlight: Jeff Yoshimura on his Asian American heritage & AAPI Month
- Misconfigurations, known unpatched vulnerabilities, and Cloud Native Application Security
- Prevent cloud misconfigurations in HashiCorp Terraform with Snyk IaC
- Joining forces with FossID to extend developer-first security to C/C++ applications
- Snyk streamlines procurement with AWS Marketplace Solution Provider Private Offers (SPPO)
- Trend Micro launches Cloud One Open Source Security powered by Snyk
- 6 Reasons to use source code analysis
- SuiteCRM: PHAR deserialization vulnerability to code execution
- Snyk Code is now available for free
- Snyk uncovers malicious code activities in open source supply chain security on the npm registry
- GitHub Security Code Scanning: Secure your open source dependencies
- How AppSec has evolved in 2021: Reddit’s perspective
April 2021
- Snyk & Intuit roundtable: Breaking silos, engaging with security and developer communities
- Performance in OPA Rego: Bottom-up and top-down
- Why developer-first SAST tools are the future of code security
- Secure Elixir development with Snyk
- Celebrating four years of developer-first integrations at Atlassian Team ‘21
- Snyk IaC public beta introduces Terraform plan analysis
- Announcing the Snyk Team plan: Secure development for teams
- Snyk Maven plugin: Integrated security vulnerability scanning for developers
- Code Dx 5.3 integrates with Snyk for comprehensive vulnerability management
- Snyk @ Snyk: Enabling Kubernetes RBAC for Snyk’s Developers
- Python language support now beta in Snyk Code
- Securing cloud native applications: ActiveCampaign’s VP, Information Security provides perspective
- How to fix Java security issues while coding in IntelliJ IDEA
- Secure coding with Snyk’s new JetBrains IDE plugin
- View and report on all of your Snyk Infrastructure as Code configuration issues
- 5 ways to prevent code injection in JavaScript and Node.js
- Snyk chats with Shutterstock about building a DevSecOps culture
- Scanning Red Hat Quay registry images for vulnerabilities with Snyk
- Scanning Harbor registry images for vulnerabilities with Snyk
March 2021
- Application security automation for GitHub repositories with Snyk
- Secure coding with Snyk Code: Ignore functionality with a twist
- Preventing YAML parsing vulnerabilities with snakeyaml in Java
- SQL injection cheat sheet: 8 best practices to prevent SQL injection attacks
- Developer driven workflows: Dockerfile image scanning, prioritization, and remediation
- Top 10 DevOps Tools
- Backstage integration with the Snyk API
- DevOps Security best practices
- Automate container security with Dockerfile pull requests
- Defining developer-first container security
- Docker Hub authentication: Is 2021 the year you enable 2FA on Docker Hub?
- Solving Java security issues in my Spring MVC application
- How I was hacking docker containers by exploiting ImageMagick vulnerabilities
- Snyk expands into Asia Pacific Japan
- Our Journey to Today
- 10 Kubernetes Security Context settings you should understand
- Snyk’s new vulnerability cards - fix issues fast with a new look and feel
- SolarWinds Orion Security Breach: A Shift In The Software Supply Chain Paradigm
February 2021
- Java configuration: how to prevent security misconfigurations
- Shifting left security incident management with the Snyk & Opsgenie integration
- Snyk IaC scanning enhancements include Azure and AWS infrastructure as code
- Snyk-Watcher: keep Snyk in sync
- Extensibility and the Snyk API: our vision, commitment, and progress
- 4 steps of the Vulnerability Remediation Process
- Java ecosystem survey 2021
- Snyk kicks off Community Outreach Internship Program
- Security Vulnerability explained: types and remediation
- AWS vulnerability scanning using the Snyk integration
- Go security cheatsheet: 8 security best practices for Go developers
- The State of Cloud Native Application Security survey—2021
- What makes Verdaccio a successful project?
- Learnings from our 2021 kickoff
January 2021
- Snyk and Rapid7 strengthen partnership to provide a holistic risk assessment solution for container applications
- Identify, prioritize, and fix vulnerabilities with Reachable Vulnerabilities for GitHub
- Kubernetes securityContext: Linux capabilities in Kubernetes
- Goodbye, 2020! Look out, 2021
- Docker for Node.js developers: 5 things you need to know not to fail your security
- Prioritize fixes more efficiently with Reachable Vulnerabilities for GitHub
- Cache poisoning in popular open source packages
- What is typosquatting and how typosquatting attacks are responsible for malicious modules in npm
- Securing your Kubernetes application development with Snyk and Tilt
- Applying risk management to DevOps practices with Snyk & Datadog
2020 220
December 2020
- 2020 Q4 in review—iOS remote code execution, developer-first SAST, and more
- 2020 Q3 in review—Snyk & DeepCode, Angular security best practices, and more
- 2020 Q2 in review—State of Open Source Security report, DevSecOps Hub, and more
- 2020 Q1 in review—JVM ecosystem report, DevSecOps insights, and more
- Golang security: access restriction bypass vulnerability in JWT
- What makes Fastify a successful project?
- Blazing the trail for cloud native application security
- Serialization and deserialization in Java: explaining the Java deserialize vulnerability
- Security concerns of third-party JavaScript scripts
- Go security: announcing enhanced security for Go applications
- Git checkout remote branch: how it works and when to use it
- Snyk’s approach to container security research and relative importance
- How to detect the ExternalIP Kubernetes vulnerability in your Kubernetes configurations with Snyk
- Command line tools for containers—using Snyk with Buildah, Podman, and Skopeo
- Improved security testing for git-based Gradle projects using lockfile
- 10 Tips for getting that conference CFP accepted
- Kernel privilege escalation: how Kubernetes container isolation impacts privilege escalation attacks
- 10 git aliases for a faster and productive git workflow
- Cheatsheet: top 10 application security acronyms
November 2020
- Turn the senior around: an alternative way to lead engineering teams
- How do we secure Infrastructure as Code tools?
- Snyk CLI cheat sheet
- Command injection: how it works, what are the risks, and how to prevent it
- DevSecOps tools for open source projects in JavaScript and Node.js
- Buffer overflow in Chromium affecting multiple packages
- Kubernetes Operators: automating the release process
- Docker for Java developers: 5 things you need to know not to fail your security
- International Men’s Day—it’s time to talk
- Announcing the Snyk and Docker Security Guide for Developers
- Container image formats under the hood
- Launching the Snyk Community Outreach Internship Program
- RPM Package Manager: RPM package security scanning with Snyk
- Python Poetry package manager and security integration with software composition analysis tool
- From zero to security hero: test your GitHub projects for known vulnerabilities
- Detect vulnerabilities in Dockerfiles, directly from Git
- Java logging: what should you log and what not?
- GitHub Actions to securely publish npm packages
- Enterprise security best practices for managing vulnerabilities at scale
- How we promote inclusivity in our job descriptions
- Node.js security: lessons from the Node.js Security Working Group in triaging vulnerabilities
- Developing secure software: how to implement the OWASP top 10 Proactive Controls
- Privileged Docker containers—do you really need them?
- Tips to scale your DevSecOps organization from Gene Kim and Guy Podjarny
October 2020
- The new, improved Snyk Container CLI
- How Atlassian CISO Adrian Ludwig built a world-class product security team
- Key approaches for effective security risk management & prioritization
- Regular Expression Denial of Service (REDoS) in UAParser.js
- Snyk user community...3,2,1...LAUNCH!
- Gradle dependencies: scanning with new Snyk Gradle plugin
- Vulnerability remediation process: reducing your vulnerability backlog with Snyk’s automatic backlog PRs
- SnykCon Day Two wrap-up: Integrations and partnerships galore & session highlights
- SnykCon Day One wrap-up: Snyk Code, carbon neutrality & session highlights
- Announcing developer-first SAST with Snyk Code
- SourMint malicious SDK research write up
- Happiness in the year of COVID-19
- SourMint: iOS remote code execution, Android findings, and community response
- OWASP Top 10 Vulnerabilities
- JHipster security scanning with Snyk
- Snyk and Secure Code Warrior: adding more context to GitHub code scanning alerts
- 15 Application Security Best Practices
- Why your team should attend SnykCon 2020
- Showing Snyk security information in GitHub code scanning
- Scanning ARM container images with Snyk
September 2020
- Enabling application security management at scale
- How to scale successfully with Snyk’s Project Attributes and Tags
- Snyk and Trek10 publish new AWS Quick Start Guide to secure serverless CI/CD deployments
- How to deploy a Vue.js Jamstack application on Netlify with automatic security updates from Snyk
- Accelerating our developer-first vision with DeepCode
- 7 tips for prioritizing container and web application vulnerabilities
- Simplify Snyk and AWS integration with our latest AWS Quick Start
- What is the BSD License? Top 10 questions answered
- Arbitrary code execution in Grunt
- A glimpse into diversity at Snyk
- 5 tips for using the Rego language for Open Policy Agent (OPA)
- Snyk and Rapid7 partnership expand capabilities to enhance security for cloud native applications
- Scaling security with DevSecOps at a Forbes Cloud 100 company
- Fixing vulnerabilities in Maven projects
- Prioritizing container vulnerabilities with exploit maturity
- Snyk Closes $200M to Modernize Security Industry
- Helping Python developers shift security left with a new PyCharm plugin
- Building a secure Amazon S3 bucket (AWS)
- Looking at the Snyk integration with Red Hat CodeReady Dependency Analytics
- New Gartner Market Guide highlights the importance of Software Composition Analysis (SCA)
August 2020
- Snyk & Trend Micro deepen collaboration with a new solution for solving open source development risks
- Enhancing security testing for Go projects using DepGraphs
- SourMint: Malicious code, ad fraud, and data leak in iOS
- SourMint malicious SDK research writeup
- Prototype pollution in express-fileupload
- New ESG research points out key application security trends
- Reachable vulnerabilities: how to effectively prioritize open source security
- Announcing Snyk’s developer-first Infrastructure as Code security capabilities
- Career growth in a scale-up world
- Snykers spoke, we listened—Snyk collects 4 Best Place to Work awards by Comparably
- Java dependency management: how many lines of code does my application hold?
- Angular security best practices
- Prioritizing vulnerabilities in Kubernetes deployments
- Breaking out of message brokers
- Instant security information with the Snyk security badge
- Prioritization on steroids with Snyk’s new Priority Score
- Snyk named to the CRN 2020 Emerging Vendor list
July 2020
- Strength through diversity
- Optimizing prioritization with deep application-level context
- New AWS Quick Start available to secure Amazon Elastic Kubernetes Service (Amazon EKS) workloads
- Announcing Snyk’s developer-first prioritization capabilities
- Helping developers prioritize the security backlog
- Arbitrary File Write via Archive Extraction (Zip Slip) in go-rpmutils
- Top tips for handling remote working fatigue
- Navigate 3 trends in financial services with DevSecOps
- LGBTQ+ in tech: from building apps to spreading magic—part II
- Import an existing infrastructure into Terraform
June 2020
- Demystifying HTTP request smuggling
- Manage multiple Terraform environments
- LGBTQ+ in tech: from building apps to spreading magic—part I
- The State of Open Source Security 2020
- Regular Expression Denial-of-Service in websocket-extensions
- The DevOps virtual conference we built with the help of Snyk and Patrick Debois
- Celebrating Pride Month—Snyk style!
- Git, the easy way: changing history using rebase—part II
- How to maintain npm dependencies in your project
- The top 3 reasons to join the AWS, CircleCI, and Snyk webinar on the DevSecOps journey
- Git, the easy way: changing history using rebase—part I
- Discover package vulnerabilities with the Snyk integration for JSDelivr
- Our privilege is our responsibility
- Announcing enhanced end-to-end security for Bitbucket Cloud development workflows
- Checking Helm Charts for security misconfigurations
- Fix vulnerabilities with confidence, with Snyk’s ML-powered Merge Advice
- SDRing during COVID-19—Snyk style!
May 2020
- Engineering equal opportunities at Snyk
- Why do organizations trust Snyk to win the open source security battle?
- 4 tips to manage multiple Terraform versions
- How to manage Terraform state?
- Using Snyk to implement end-to-end DevSecOps on Microsoft Azure
- Mitigating clickJacking — the DevSecOps way!
- Java turns 25—aging like fine wine or more like milk?
- Sum a List of numbers in Java
- 3 tips to manage drift from manual changes in Terraform
- Mental Health Awareness—three important manager lessons that I couldn’t have done without
- 3 big Amazon S3 vulnerabilities you may be missing
- Snyk launches DevSecOps Hub
- Manage risk more efficiently using Snyk’s new Project Tags API
- Detecting application vulnerabilities in container images
- Open source tools for Terraform code testing
- Website security score explained
- A moment of respite for our mental health
April 2020
- Managing license compliance across your organization with Snyk’s license policies
- Snyk achieves AWS Lambda Ready designation
- Snyk and Red Hat empower developers to secure OpenShift applications
- Why did is-promise happen and what can we learn from it
- 5 Common open source security myths everyone needs to know
- Announcing Snyk’s developer-first license compliance management
- How to successfully roll out developer-first license compliance
- Finding meaning amidst so much unknown
- Snyk achieves Amazon Linux 2 ready designation
- Secure code review: 8 security code review best practices
- Snyk Container certified “VMware PKS Partner Ready” to find and fix vulnerabilities in container workloads
- Dependency management tools for Python
- Snyk vulnerability disclosure program: what’s going on behind the scenes?
- Yarn 2 plugins - an introduction
- A recap of our Kubernetes configuration security announcement and webinar
- Snyk Integrates with AWS to Help Enterprises Build Secure Applications
- Fixing insecure Kubernetes configuration at the source
- Responsible disclosure: the impact of vulnerability disclosure on open source security
- VS Code extension: building auto CI/CD with GitHub Actions
- Yarn 2 — the future of package managers for JavaScript?
- Vuln Cost: Effortless finding vulnerabilities in npm packages with VS Code
- Snyk participates in Atlassian Remote Summit and limited-time Bitbucket Cloud promotion
March 2020
- Vulnerable Gradle plugin-publish plugin reveals sensitive information
- March in review: State of Open Source Security survey, All.The.Talks virtual conference, and more
- Shifting responsibly left with the enhanced Snyk security gating on pull requests
- Secure development when working from home — tips and tricks
- Using UBI images to minimize container vulnerabilities
- Creating an automated cloud infrastructure testing tool with Terraform and PyTest
- Exploring the minimist prototype pollution security vulnerability
- The State of Open Source Security Survey - 2020
- Django security tips
- Examining Gartner’s 12 Things to Get Right for Successful DevSecOps
- What is a backdoor? Let’s build one with Node.js
- AngularJS Security Fundamentals
- The world since coronavirus: adapting quickly to a fully remote environment
- To our Community from the Snyk Team
- How cloud transforms IT security into AppSec
- How to Detect and Remediate Kubernetes Vulnerability CVE-2019-11249
- Fastify Node.js framework improves JSON security thanks to a security report
- A call to growing tech companies — how to move the needle on gender equality together
- Popular Python library, urllib3, subject to a denial of service vulnerability
- Snyk partners with the makers of Greenkeeper to help developers proactively maintain dependency health
- Is your website vulnerable? Let’s fix it!
- Snyk named to CRN’s Security 100 list
- RSA 2020: who we met and what we learned
- Automating Kubernetes workload security reporting
February 2020
- February in review: JVM Ecosystem Report, Python and Container Updates, and more
- Streamline Kubernetes security in Amazon Web Services
- Automating remediation for vulnerabilities in Python dependencies using Snyk
- Ghostcat breach affects all Tomcat versions
- Snyk Announces New Rapid7 Strategic Partnership at RSA 2020
- 5 ways Snyk helps you to prioritize and fix your vulnerabilities
- Building a culture of Digital Trust
- Security breach leaks the personal data of all 6.5 million Israeli voters
- How can a Content Security Policy prevent XSS and other vulnerabilities?
- Find and fix vulnerabilities in Artifactory container repositories
- Node.js release fixes a critical HTTP security vulnerability
- JVM Ecosystem Report 2020
- 36% of developers switched from Oracle JDK to an alternate OpenJDK distribution, over the last year
- 64% of developers report that Java 8 remains the most often used release
- Kotlin overtakes Scala and Clojure, becoming the 2nd most popular language on the JVM ecosystem
- Spring dominates the Java ecosystem with 60% using it for their main applications
- IntelliJ IDEA dominates the IDE market with 62% adoption among JVM developers
- Protecting our culture as we hyperscale
- 86% of security and tech roles agree that security is a shared responsibility
January 2020
- January in review: funding news, DevSecOps insights study, and much more
- Is LocalStorage safe to use?
- 31% don’t track application dependencies and 38% only track direct dependencies
- 29% of highest security integration orgs endure friction when collaborating
- 48% see security a major constraint on the ability to deliver software quickly
- DevSecOps Insights 2020
- The cost of a security breach
- Scaling security through DevSecOps & dev-first security
- Snyk Closes $150M to Accelerate Developer-first Security
- Navigating your own career growth in a hyper-growth startup
- Understanding filesystem takeover vulnerabilities in npm JavaScript package manager