Xygeni Logo White
Start Free
Book a demo

Xygeni Blog

Must-Read Posts

API Security

API Security Has Been a Runtime Problem. It Doesn’t Have to Be

Most API security tools catch risk after it's live. Static analysis mapped to the OWASP API Top 10 catches it in the pull request instead.
7 min read
Npm Supply Chain Attacks

Npm Supply Chain Attacks: Biggest Incidents & How to Stop Them

A timeline of the biggest npm supply chain attacks, from Shai-Hulud to chalk/debug, and the controls that stop the next npm package attack.
7 min read
How AI Agents Can Automate a Ransomware Attack

How AI Agents Can Automate a Ransomware Attack: What JadePuffer Just Proved

JadePuffer showed an AI agent can run a ransomware attack start to finish. Here's how it happened, and how to stop agentic threats early.
9 min read
Cyber Resilience Act timeline

The Cyber Resilience Act Timeline: Every Deadline From 2024 to 2027

The full Cyber Resilience Act timeline: every CRA deadline from 2024 to 2027, what's already binding, and how to prepare before Sept 11, 2026.
7 min read
QuietPolyfill, an NPM dropper that resurrected

QuietPolyfill: An NPM dropper that resurrected

QuietPolyfill: an npm dropper that triggers on import, bypassing --ignore-scripts entirely, and came back a day later. Take a look!
14 min read
cybersecurity threats

Cybersecurity Threats in 2026: How AI Threats Are Reshaping the Attack

Cybersecurity threats are evolving fast as AI enters the software supply chain. Check data behind rising AI threats & how to reduce exposure
6 min read
AI Attack Surface

The AI Attack Surface Nobody Is Taking into Account

Your AI attack surface grows with every agent-written line of code. See how slopsquatting & poisoned skills exploit it & how to close the gap
8 min read
rogue by design

Rogue by Design: How a Sandboxed Pre-Release Model Jailbroke Itself and Hacked Hugging Face to Cheat an Exam

An OpenAI model escaped its sandbox and breached Hugging Face on its own, to cheat a benchmark exam. No human attacker. Here's how.
23 min read
code-quality-scanner-appsec

Code Quality and Code Security Have Been Living in Two Different Tools. They Don’t Have To.

Code smells & vulnerabilities live in the same codebase but get scanned by different tools. See how our Code Quality scanner closes that gap
7 min read
PointBlank: PyPI RAT Hides C2 in a JSON-Bin Service

PointBlank: a fully-featured Python RAT that ran its command channel through a free note-hosting service

A PyPI package called gcli-control shipped a full Windows RAT openly & ran its command channel through npoint.io instead of a server it owned
8 min read
AI in Cybersecurity

AI in Cybersecurity: Attack Vector & Defense Tool

AI in cybersecurity cuts both ways: it writes phishing & cuts SOC alert fatigue in half. This post covers both sides of the fight. Dive in!
9 min read
How to Detect and Eliminate Shadow AI Risk

How to Detect and Eliminate Shadow AI Risk?

Shadow AI risk is already inside your pipelines, with no install and no paper trail. Learn how to detect & eliminate it!
8 min read
Load More