# keepsecure labs > Application security research lab. We publish weekly analyses of vulnerabilities, exploits, and attack patterns that matter — what the bug is, who's exposed, and what to do about it before Monday. Research tracks what attackers are doing, not what scanners flag. ## Research focus areas - [Offensive research](https://keepsecure.io/research/offensive.html): How attackers break production software. Scope: browser zero-days, CI/CD injection, AI supply chain, cloud infrastructure, web apps, mobile, APIs, embedded firmware, broadband gear, management-plane auth bypasses. - [Defensive research](https://keepsecure.io/research/defensive.html): What defenders should do about what offensive research surfaces. Detection engineering, tool-output triage, AI agent guardrails, prompt-injection defense, MLOps access boundaries, AppSec program maturity across the 15 SAMM domains. - [In-the-wild research](https://keepsecure.io/research/in-the-wild): Coverage of the active threat landscape — CVE analyses under live exploitation, threat-actor profiles, campaign tracking, emerging-threat reports, and IOC publications. The hub at https://keepsecure.io/hub is the live feed of these analyses. ## Recent analyses (24 total) - [Shai-Hulud closes the loop: how the worm reached intercom-client in 24 hours](https://keepsecure.io/hub/shai-hulud-npm-worm-intercom-client-2026) — The Shai-Hulud worm closed its loop in 24 hours: OIDC tokens from April 29 npm victims published intercom-client@7.0.4 the next day. (2026-05-04) - [The Bun runtime is becoming the malware delivery vehicle of 2026](https://keepsecure.io/hub/bun-runtime-supply-chain-stealer-april-2026) — Two supply-chain compromises in 48 hours both fetch Bun and run an obfuscated credential stealer. Lightning PyPI and four SAP CAP npm packages, both Team PCP. (2026-04-30) - [Team PCP: tracking a six-week supply-chain campaign through Trivy, Checkmarx, Bitwarden, and beyond](https://keepsecure.io/hub/teampcp-supply-chain-campaign-tracking) — A self-spreading credential-theft campaign that has chained through six security-tooling vendors since March 2026. Patterns, IOCs, and detection guidance. (2026-04-30) - [Vercel's April 2026 incident: an OAuth-app supply chain in three hops](https://keepsecure.io/hub/vercel-oauth-supply-chain-april-2026) — Vercel's April 2026 breach moved from a third-party AI tool to a Workspace account to internal Vercel access. The OAuth-app supply-chain pattern in detail. (2026-04-30) - [The AI agent as confused deputy: a 2026 attack class](https://keepsecure.io/hub/ai-agent-confused-deputy-pattern) — Four recent CVEs reveal the AI agent as confused deputy: privileged process, attacker-controlled input. The class named, mapped, and defended. (2026-04-29) - [Where AI-IDE threats actually live: telemetry beyond the dark web](https://keepsecure.io/hub/ai-ide-marketplace-security-telemetry) — Dark-web sweeps come up empty for AI-IDE threats — but the threat exists. It's on the legitimate marketplace. Where to look and what to alert on. (2026-04-29) - [Four AI-coding-agent-stack CVEs you should patch first](https://keepsecure.io/hub/ai-coding-agent-cves-patch-priority) — A short cluster of CVEs has hit the runtime stack AI coding agents rely on — npm install, Docker, LangChain, model loaders. Patch order and structural fixes. (2026-04-29) - [CopyFail crossed onto a carding forum in seven days. Here's why that matters.](https://keepsecure.io/hub/copyfail-time-to-criminalization-seven-days) — CVE-2026-31431 was disclosed on April 22. By April 30 it was an active thread on a carding forum's Exploits section. The seven-day crossing tells you which Linux LPE class the criminal market actually buys. (2026-04-29) - [CVE-2026-31431: Copy Fail — four bytes into the Linux page cache for root](https://keepsecure.io/hub/cve-2026-31431-copyfail-linux-page-cache-lpe) — A 2017 algif_aead in-place optimization lets an unprivileged user write four controlled bytes into the page cache of any readable file. 732-byte exploit, no race condition, every Linux distribution since 2017 — including across containers. (2026-04-29) - [CVE-2026-2091: io_uring race turns any local user into root](https://keepsecure.io/hub/cve-2026-2091-linux-io-uring-race-lpe) — A TOCTOU race in the Linux io_uring fixed-file-table cleanup path lets any unprivileged user trigger a use-after-free on the task credentials struct, leading to root. Working PoC public. CVSS 7.8. Patched in 6.8.9, 6.7.11, 6.6.28 LTS. (2026-04-24) ## About the lab - [About](https://keepsecure.io/about): What we publish, how we work, why independent research - [Contact](https://keepsecure.io/contact): Collaboration, press, advisory inquiries ## Related GitHub resources - [keepsecure-labs on GitHub](https://github.com/keepsecure-labs): Org home, lab profile - [keepsecure-labs/artifacts](https://github.com/keepsecure-labs/artifacts): Detection artifacts, IOCs, reproducers — Apache-2.0 - [Full post feed (JSON)](https://keepsecure.io/hub.json): Machine-readable feed of all analyses - [Full content (markdown)](https://keepsecure.io/llms-full.txt): All analyses concatenated as plain markdown ## Publishing cadence Weekly. New analyses every Monday-ish. Authors: small team of application-security engineers; current byline: `falco365`. ## License Analysis text: © keepsecure labs. Detection artifacts in the artifacts repo: Apache-2.0.