Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On November 24th, 2025, we identified a new supply chain attack in the npm ecosystem, referred to as SHA1-Hulud. We believe this is a second wave of the Shai-Hulud attack, which occurred in September 2025. Snyk will continue monitoring this active incident until it is resolved. Updates on this incident will be on our trust center.

For CISOs planning cloud migrations: Your decade of Jira and Confluence data contains thousands of exposed credentials, patient records, and payment card numbers. Here's how to clean it up and secure it after migration.

Ask most people what “consent” means and you’ll hear about a banner that asks to collect cookies. That was yesterday. Modern LLMs ingest emails, tickets, docs, chats, and logs. They create embeddings, reference snippets with retrieval, and sometimes fine-tune on past conversations. If you do not wire user consent into each of those steps, you either violate laws, lose user trust, or both. That is why user consent is revolutionizing LLM privacy practices.

As the surface area for attacks on the web increases, Cloudflare’s Web Application Firewall (WAF) provides a myriad of solutions to mitigate these attacks. This is great for our customers, but the cardinality in the workloads of the millions of requests we service means that generating false positives is inevitable. This means that the default configuration we have for our customers has to be fine-tuned.

The world of cyber security is on the cusp of a fundamental transformation. For decades, the primary security model has been one of prevention building higher walls and stronger gates to keep adversaries out. But as we look toward 2026, this fortress mentality is proving insufficient.