Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On November 24th, 2025, we identified a new supply chain attack in the npm ecosystem, referred to as SHA1-Hulud. We believe this is a second wave of the Shai-Hulud attack, which occurred in September 2025. Snyk will continue monitoring this active incident until it is resolved. Updates on this incident will be on our trust center.

For CISOs planning cloud migrations: Your decade of Jira and Confluence data contains thousands of exposed credentials, patient records, and payment card numbers. Here's how to clean it up and secure it after migration.

Ask most people what “consent” means and you’ll hear about a banner that asks to collect cookies. That was yesterday. Modern LLMs ingest emails, tickets, docs, chats, and logs. They create embeddings, reference snippets with retrieval, and sometimes fine-tune on past conversations. If you do not wire user consent into each of those steps, you either violate laws, lose user trust, or both. That is why user consent is revolutionizing LLM privacy practices.

As the surface area for attacks on the web increases, Cloudflare’s Web Application Firewall (WAF) provides a myriad of solutions to mitigate these attacks. This is great for our customers, but the cardinality in the workloads of the millions of requests we service means that generating false positives is inevitable. This means that the default configuration we have for our customers has to be fine-tuned.

Artificial intelligence (AI) is everywhere in cybersecurity marketing. Real AI is not about detecting more. It is about making decisions faster and more precisely, so that humans can spend their time on what truly matters. Endpoint security efficiency is the ability to deliver maximum protection with minimum operational effort, turning noise into clarity and alerts into meaningful incidents. AI is the engine that makes this possible.

A significantly evolved version of the Shai-Hulud malware now tracked as Sha1-Hulud has been discovered with over 800 packages affected, now featuring persistent backdoor capabilities through compromised GitHub Actions runners and enhanced multi-cloud credential harvesting.