Forrester has named Semgrep a Strong Performer in the first edition of The Forrester Wave™: Agentic Development Security ...

AI tokens are getting cheaper, but enterprise AI bills keep climbing. The question worth asking is what those tokens are being used for. The cost of using large language models (LLMs) has dropped ...

Semgrep Guardian goes self-serve with Codex support, plus incident-first advisories and transitive Autofix. See everything ...

Semgrep is sponsoring our friends at OWASP Netherlands Chapter's next meetup – taking place on 29th October at KvK HQ, Utrecht. We're looking forward to catching up with the Dutch AppSec community!

One Brotli decoder bug. A lot of copies. TL;DR - CVE-2026-111497 is an out-of-bounds write in the Brotli decompressor in google/brotli, fixed upstream in 1.2.1. It is not a separate Node, PHP, or npm ...

Semgrep is now part of Cursor Origin - bringing automated security scanning directly to repositories hosted in Cursor. If ...

This blog post provides code examples for both ASP.Net and .Net Core, emphasizing the importance of security headers and encouraging readers to refer to OWASP Security Headers Guidance for more ...

We show that none of three flagship or two open-source models find two of the vulnerabilities discussed in the Mythos blog post, without extremely revealing hints. Discovery is orders of magnitude ...

Semgrep is a code analysis tool many use for application security scanning (SAST). One of the design principles that has guided Semgrep’s development so far is supporting every programming language.

intercom/intercom-php 5.0.2 was compromised and converted into a Composer plugin that exfiltrates credentials at install time, extending the Mini Shai-Hulud campaign to PHP. After compromising ...