The Leader in Cloud Security Research

A stylized graphic of a pipeline being disrupted by code

Critical 9.3 Severity LangChain Serialization Flaw Enables Secret Theft

A critical vulnerability (CVE-2025-68664, CVSS 9.3) was disclosed affecting the LangChain open-source LLM framework, allowing attackers to steal sensitive data and potentially trigger unintended actions via prompt injection. Due to the potential for environment variable exposure and unauthorized logic execution, immediate patching is required. The issue originates from LangChain’s (and LangChain Core’s) data serialization logic, …

December 25, 2025
By Roi Nisimi

Latest

All Latest

Discovered Vulnerabilities

New runC Vulnerabilities Expose Docker and Kubernetes to Container Escape Attacks

This week, three new high-severity vulnerabilities were revealed in runC, the fundamental runtime technology used by most container platforms. This impacts major systems such as Docker, containerd, Kubernetes, and virtually all managed Kubernetes services offered by major cloud providers. These vulnerabilities combined allow for a container escape, where a malicious factor can break out of …

November 10, 2025
By Shir Sadon

A stylized graphic of the word CVE Alert next to a broken cog

CVE-2025-59287 Explained: Critical WSUS RCE Vulnerability Actively Exploited

October 26, 2025

A stylized graphic of a pull request from GitHub with a hole in it and data leaking out

pull_request_nightmare Part 2: Exploiting GitHub Actions for RCE and Supply Chain

September 30, 2025

A stylized graphic showing a pull request window with malicious code

pull_request_nightmare Part 1: Exploiting GitHub Actions for RCE and Supply Chain Attacks

September 24, 2025

A stylized graphic of floating packages in a dark cloud background

Massive npm Malware Campaign Infects Popular Packages, @ctrl/tinycolor Affected

September 16, 2025

All Discovered Vulnerabilities

2025 State of Cloud Security Report: Hunting threats in the age of relentless risk

Get the report

Critical 9.3 Severity LangChain Serialization Flaw Enables Secret Theft

Latest

Critical Unauthenticated MongoDB Heap Memory Leak Vulnerability Leaks Sensitive Data

Critical n8n RCE vulnerability enables full server compromise

Additional React and Next.js RSC Vulnerabilities Lead to Denial-of-Service and Source Code Disclosure

The Cloud's Year-End Confessions: What Really Happened in 2025

Explore

Discovered Vulnerabilities

New runC Vulnerabilities Expose Docker and Kubernetes to Container Escape Attacks

CVE-2025-59287 Explained: Critical WSUS RCE Vulnerability Actively Exploited

pull_request_nightmare Part 2: Exploiting GitHub Actions for RCE and Supply Chain

pull_request_nightmare Part 1: Exploiting GitHub Actions for RCE and Supply Chain Attacks

Massive npm Malware Campaign Infects Popular Packages, @ctrl/tinycolor Affected

‘Orca Watch’ Series

Critical 9.3 Severity LangChain Serialization Flaw Enables Secret Theft

Critical Unauthenticated MongoDB Heap Memory Leak Vulnerability Leaks Sensitive Data

Critical n8n RCE vulnerability enables full server compromise

Additional React and Next.js RSC Vulnerabilities Lead to Denial-of-Service and Source Code Disclosure

React and Next.js Vulnerabilities Enable Remote Code Execution

Technical Deep Dives

Watch the Typo: Our PoC Exploit for Typosquatting in GitHub Actions

Kubernetes Testing Environment: An Open Source Resilience Platform for EKS, GKE and AKS

Meet AI Goat: The First Open Source AI Security Learning Environment Based on the OWASP Top 10 ML Risks

The Five Most Common AI Model Risks and How to Prevent Them

Leveraging Nuclei Templates to Identify Risks and Threats in Critical Cloud Applications

Thought Leadership

Where to Start Your Cloud Security Program: CSPM, CWPP, or Runtime Data? A Modern Guide to CNAPP Maturity

The Cloud's Year-End Confessions: What Really Happened in 2025

OWASP Top 10 2025: Key Changes and What They Mean for Application Security

Part 2: Attackers Love Your GitHub Actions Too

Part 1: Attackers Love Your GitHub Actions Too

In the News

The 10 Hottest Cybersecurity Tools And Products Of 2025 (So Far)

From ’Shadow AI’ To Agentic Anarchy, AI-SPM Is Key To Visibility: Experts

Cloud security faces mounting threats, Orca warns

2025 State of Cloud Security Report: Hunting threats in the age of relentless risk

Featured

Critical 9.3 Severity LangChain Serialization Flaw Enables Secret Theft

Latest

Critical Unauthenticated MongoDB Heap Memory Leak Vulnerability Leaks Sensitive Data

Critical n8n RCE vulnerability enables full server compromise

Additional React and Next.js RSC Vulnerabilities Lead to Denial-of-Service and Source Code Disclosure

The Cloud's Year-End Confessions: What Really Happened in 2025

Discovered Vulnerabilities

New runC Vulnerabilities Expose Docker and Kubernetes to Container Escape Attacks

CVE-2025-59287 Explained: Critical WSUS RCE Vulnerability Actively Exploited

pull_request_nightmare Part 2: Exploiting GitHub Actions for RCE and Supply Chain

pull_request_nightmare Part 1: Exploiting GitHub Actions for RCE and Supply Chain Attacks

Massive npm Malware Campaign Infects Popular Packages, @ctrl/tinycolor Affected

‘Orca Watch’ Series

Critical 9.3 Severity LangChain Serialization Flaw Enables Secret Theft

Critical Unauthenticated MongoDB Heap Memory Leak Vulnerability Leaks Sensitive Data

Critical n8n RCE vulnerability enables full server compromise

Additional React and Next.js RSC Vulnerabilities Lead to Denial-of-Service and Source Code Disclosure

React and Next.js Vulnerabilities Enable Remote Code Execution

Technical Deep Dives

Watch the Typo: Our PoC Exploit for Typosquatting in GitHub Actions

Kubernetes Testing Environment: An Open Source Resilience Platform for EKS, GKE and AKS

Meet AI Goat: The First Open Source AI Security Learning Environment Based on the OWASP Top 10 ML Risks

The Five Most Common AI Model Risks and How to Prevent Them

Leveraging Nuclei Templates to Identify Risks and Threats in Critical Cloud Applications

Thought Leadership

Where to Start Your Cloud Security Program: CSPM, CWPP, or Runtime Data? A Modern Guide to CNAPP Maturity

The Cloud's Year-End Confessions: What Really Happened in 2025

OWASP Top 10 2025: Key Changes and What They Mean for Application Security

Part 2: Attackers Love Your GitHub Actions Too

Part 1: Attackers Love Your GitHub Actions Too

The 10 Hottest Cybersecurity Tools And Products Of 2025 (So Far)

From ’Shadow AI’ To Agentic Anarchy, AI-SPM Is Key To Visibility: Experts

Cloud security faces mounting threats, Orca warns

2025 State of Cloud Security Report: Hunting threats in the age of relentless risk