It is with a complicated mixture of grief, relief, and the quiet satisfaction of an "I told you so" held in for over a decade that we record the passing of automatic lifecycle script execution in npm, ...

Our new monthly look at what Semgrep shipped and why. This month: what we built when six incidents hit in one day, and everything else that shipped in October. On October 21, six security incidents ...

One Brotli decoder bug. A lot of copies. TL;DR - CVE-2026-111497 is an out-of-bounds write in the Brotli decompressor in google/brotli, fixed upstream in 1.2.1. It is not a separate Node, PHP, or npm ...

TL;DR: We continue our previous research in evaluating Claude Code and OpenAI Codex on finding vulnerabilities in real, open-source applications, with simple prompts and no scaffolding. In this post ...

AI agents are writing code now. That part is settled. The question security teams should be asking is: how do you make those agents write secure code from the start, rather than trying to catch ...

We want using Semgrep to be like hiring an AppSec engineer to do the boring work. To be the best platform for code scanning, Semgrep must go beyond finding issues. It must autonomously remove noise, ...

Semgrep Supply Chain now covers the whole path for malicious dependencies: detecting exposure within minutes, responding automatically, and blocking malware before it's installed. Org-wide policies ...

Are you ready to take your coding skills to the next level and ensure that your code is safe and secure on the internet? This exclusive training led by renowned security expert Tanya Janca will cover ...

You can do everything right and still get compromised. Part four of the Cybersecurity Readiness Month series covers how to contain an attacker, respond fast, and recover cleanly once they’re in. For ...

It's been a busy week for supply chain incidents. Yesterday the PHP Foundation disclosed PHP2Shell, a vulnerability that has existed in PHP for over a decade. We broke down how that worked in our post ...