Security Research & Insights
Cybersecurity stories, threat analysis, and practical guidance from the Deva security team.
OWASP published the 2025 revision of the Top 10 in May 2026. Three structural changes deserve real attention from anyone writing or auditing application code.
A self-propagating supply chain worm compromised TanStack npm packages through GitHub Actions cache poisoning. No credentials stolen, just OIDC tokens extracted from runner memory.
CVE-2026-31431 is a local privilege escalation in the Linux kernel cryptographic subsystem. A 732-byte Python script can edit a setuid binary in memory and obtain root. CISA added it to KEV on May 7.
A cross-site scripting flaw in on-premises Microsoft Exchange Server enables email spoofing via crafted messages. CISA added it to KEV on May 15 with a May 29 federal deadline.
CVE-2026-42945 is a critical heap buffer overflow in NGINX rewrite module that has existed since 2008. CVSS 9.2, public PoC, zero authentication required.
CVE-2026-20182 is a maximum-severity authentication bypass in Cisco Catalyst SD-WAN Controller. CISA added it to KEV with a May 17 federal remediation deadline.
The Salt Typhoon intrusions into major US telecom carriers exposed lawful intercept systems and call metadata at unprecedented scale. The takeaway for software teams: assume the transport layer is hostile.
CISA's Known Exploited Vulnerabilities catalog added 187 entries in the past 12 months. The median time from CVE disclosure to active exploitation has dropped to 5 days. Here's what that means for development teams.
Agentic AI systems combining LLMs with tool use and persistent memory have created a new vulnerability class. When the agent has shell or API access, prompt injection behaves like RCE.
HHS proposed updates to the HIPAA Security Rule in early 2025 that would make penetration testing an explicit requirement for covered entities. Here's what the proposed rule says and how to prepare.
NIST released Cybersecurity Framework 2.0 with a new Govern function and expanded scope beyond critical infrastructure. Here's what the update means at the code level.
PCI-DSS v4.0 has been the only valid revision since March 2025. Requirements 6.2 and 6.3 are the ones developers own, and they are stricter than v3.2.1 in ways most teams have not yet absorbed.
HHS recorded 725 healthcare data breaches in 2024 affecting more than 180 million records. Their disclosed technical causes cluster around a small set of CWEs, and every one of them is detectable at write time.
The XZ Utils backdoor (CVE-2024-3094) demonstrated that supply chain attacks target developer environments as much as production systems. Here's what changed and what hasn't.
FedRAMP updated its baselines to align with NIST 800-53 Rev 5. For developers building cloud services targeting government customers, here's which controls live in code.
MITRE published the 2024 CWE Top 25. Several rankings shifted meaningfully. Here's how to configure your scanner for maximum coverage of the current threat landscape.
LLM-generated code passes syntax checks, passes type checks, and fails security checks at higher rates than hand-written code. Here's why and what to do about it.
Zero-trust architecture applied to developer environments means more than network segmentation. It means the AI tools developers use can't exfiltrate code they weren't meant to see.
SOC 2 Type II auditors are moving beyond policy documentation to code-level evidence. Here's which Trust Services Criteria map directly to your application code and what auditors want to see.
Article 25 of the GDPR requires 'data protection by design and by default.' Most organizations implement this at the architecture level. Here's what it means at the code level.
CVE-2021-44228 (Log4Shell) was disclosed in December 2021 and is still being actively exploited four years on. The cause is not ignorance. It is dependency graph blindness.
CISA's Secure by Design initiative argues that meeting a compliance checklist is not the same as building safe software. The alternative is structural: design that makes whole vulnerability classes impossible rather than rare.
SOX IT General Controls (ITGCs) are designed for auditors, but many of them directly affect how software is written, reviewed, and deployed. Here's the developer's translation.