Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In less than 5 minutes, you'll learn how to set up a no-code automated workflow that generates and emails real-time vulnerability reports from Socket using the Tines Story library.

A maximum-severity vulnerability is hitting React Server Components - and if you're running Next.js, you may be vulnerable by default. React disclosed CVE-2025-55182, nicknamed React2Shell, an unauthenticated remote code execution (CVSS 10.0) affecting React Server Components via the Flight protocol. Next.js tracks downstream exposure as CVE-2025-66478: That means internet-wide scanning is likely. Who’s affected?

When AI Hallucinates Security Patches.

Functionality vs. Aesthetics in AI Models.

CVE-2026-23550 is a critical unauthenticated privilege escalation vulnerability affecting the Modular DS WordPress plugin (versions ≤ 2.5.1). With a CVSS score of 10.0, this flaw allows attackers to gain full administrator access without authentication. In this video, we break down: What CVE-2026-23550 is How the vulnerability works (technical root cause) What attackers can do after exploitation.

R&D Engineer Ryan Cribelar explains how internet exposure is a factor in risk management related to vulnerabilities and exposures.

In less than 5 minutes, you'll learn how to set up a no-code automated workflow that generates and emails real-time vulnerability reports from Socket using the Tines Story library.

Is Cursor’s new Composer 1.5 model a major leap forward, or just a marginal update? Today, we’re putting the latest version of Cursor’s agentic AI to the test using our "Production-Ready Note App" prompt. We compare the speed, UI design, and agentic capabilities of 1.5 against version 1.0. Most importantly, we run a full security audit using the Snyk extension to see if the AI-generated code is actually safe for production.

AI vs. Security: It’s a Hit or Miss.

Your next software update could be weaponized. In this short breakdown, we examine how adversaries compromised the Notepad++ update mechanism to distribute malware and how CrowdStrike identified the activity four months before public disclosure.

Vulnerability scanning is useless if you don’t fix what you find. This short breaks down a practical vulnerability remediation process to prioritize risk, patch faster, and reduce real-world exposure. Learn how security teams move from detection to closure, without months of backlog.

Which AI Writes the Safest Code?

Can you trust the code AI generates? In this video, we build a custom AI Security Benchmarking tool to put models like Gemini, Mistral, and GLM 4.5 to the test. Using Windsurf, OpenRouter, and Snyk, we automate a pipeline that prompts multiple LLMs to write an application, then immediately scans the output for security vulnerabilities.

My Boss Wanted an App by Morning... So I Used AI.

A critical vulnerability known as Metro4Shell (CVE-2025-11953) has been identified in the React Native Metro development server, enabling unauthenticated remote code execution when exposed beyond localhost. Active exploitation is already underway, with attackers targeting exposed development environments to gain system-level access. For more insights on website and API security fundamentals, subscribe to our newsletter.

My boss dropped a bombshell at 4:00 PM: build a secure, production-ready app from scratch by tomorrow morning. Instead of panicking, I put Claude Opus 4.6 to the test. In this video, I walk you through the entire end-to-end process of using an AI agent to architect, code, and debug a full-stack application. We’ll look at "Plan Mode," how the AI handles environment errors (like Windows SQLite issues), and most importantly, how we verified the AI's code for security vulnerabilities using Snyk.

CVE-2025-59287 turns WSUS (Windows Server Update Services) into a high-value attack surface—and attackers are already abusing it. In this video, we break down how CVE-2025-59287 is exploited, what defenders should look for, and how to mitigate and detect attacks before damage spreads across your environment. What you’ll learn in this video: How attackers scan exposed WSUS servers on ports 8530 and 8531.

Nucleus Security's Adam Dudley talks about the platform's place in a highly functioning CTEM approach during a joint webinar with Cycode and HackerOne.

In this conversation, Ryan Cribelar, R&D Engineer at Nucleus Security, breaks down why internet exposure is one of the most important layers of context in vulnerability and exposure management. Security teams are flooded with vulnerability data, but not every finding carries the same level of risk. As Ryan explains, whether a vulnerability is reachable from the internet can dramatically change how urgent it really is. Internet exposure shortens the path from discovery to exploitation and often determines whether a vulnerability is theoretical or immediately actionable.

AI Code Generation: 3 Critical Security Risks.

In a joint webinar with leaders from Nucleus, Cycode, and HackerOne, HackerOne product manager Kyle Mativier explains how advancing AI capabilities are collapsing how long it takes attackers to exploit seemingly low to medium severity vulnerabilities.

AI is revolutionizing software development, but it’s also generating code faster than humans can review. In this video, we dive into the three biggest security risks of AI code generation and show you how to automate your defense using Snyk Studio. Learn how to enable Secure At Inception to catch vulnerabilities in real-time within your IDE.