Checkmarx helps the world’s largest enterprises get ahead of application risk without slowing down development. We end the guesswork by identifying the most critical issues to fix and give AppSec the tools they need, all while letting developers work the way they want. From DevSecOps to developer experience, security and development teams can now work better together. That’s why 1700+ customers rely on Checkmarx to scan over 1 trillion lines of code annually, improve developer productivity by 50%, and deliver 2X AppSec ROI. Checkmarx. Always Ready To Run.
External link for Checkmarx
140 E Ridgewood Ave
South Tower Suite 415
Paramus, New Jersey 07652, US
MCP is quickly becoming the “USB-C” of AI agents, standardising how models interact with tools, data, and external systems. But with that connectivity comes something else: an entirely new security surface that extends far beyond traditional AppSec. Tal Folkman and Ricardo Goncalves outline 11 emerging security risks in the MCP ecosystem, from prompt injection and tool poisoning to confused-deputy bugs, schema manipulation, and malicious-by-design MCP servers. What makes this research important is simple: as AI agents gain more autonomy, the trust boundaries around them expand just as fast. Securing MCP isn’t just about protecting a model; it’s about safeguarding the distributed network of tools, schemas, servers, and data sources that now drive AI-powered actions. If you want to understand where the next generation of AI security threats will emerge, this is essential reading. https://lnkd.in/gAqt-T8U
People keep asking if DAST still matters in an AI-driven SDLC. Spoiler: yes. Very much yes. Ori Bendet breaks down why dynamic testing is shifting from a late-stage chore to an autonomous agent that continuously stress-tests your running application, catches AI-era issues like prompt injections and data poisoning, and fixes problems before anyone notices. DAST isn’t fading out. It’s leveling up. https://lnkd.in/e4NH95bD
New data shows rising code velocity, expanding attack surfaces, and a surge in shadow AI as teams adopt tools faster than governance can follow. In his latest article, 🚀 Eran Kinsbruner breaks down why visibility, policy control, and real-time AppSec inside the development workflow are becoming non-negotiable in the AI era, and what organizations must do now to stay ahead. 🔗 Read the full piece on the future of securing AI-generated code via Digitalisation World: https://lnkd.in/eCyDFW2C
Shai-Hulud “Second Coming” is exactly the kind of npm supply chain event teams worry about: faster propagation, harder to auto-detect, and now with destructive behavior when it can’t use the credentials it steals. Our Checkmarx Zero research team has been on this since early this morning, rapidly adding affected packages to the Malicious Package Database and publishing a community list and guidance for short-term guardrails. If your org relies on npm in CI/CD or developer environments, it’s worth tightening controls now. Darren Meyer breaks down what’s changed in this wave and what to do about it here. ⬇️
The #ShaiHulud #SecondComing is here; we’ve been all-in responding to this #malware since the attack began this morning. Propagation is faster and harder to automatically detect compared to the last infection; restricting public #NPM usage is wise until infection is controlled. Watch this space for further updates; we’re focused now on adding #MaliciousPackages versions to our database as quickly as we can. We've also provided a summary on our blog, along with a published list of detected packages (though this lags our product: our priority is of course protecting our customers, we update the public list as time allows) https://lnkd.in/g9qQzpeh
Security teams shouldn’t have to choose between development speed and strong AppSec. With Developer Assist, they don’t have to. Our capabilities bring autonomous remediation directly into the IDE, so vulnerabilities are identified, explained, fixed, and validated long before they reach the pipeline. Here’s what sets this apart: ➡️Real-time, contextual feedback as code is written ➡️Clear explanations of what makes an issue risky ➡️Best-practice remediation guidance tailored to each framework ➡️One-click autonomous fixes with syntax, build, functionality, and security verification ➡️Full visibility into every change before commit It’s secure development without the slowdown, and a major step toward eliminating friction between AppSec and engineering. Our team breaks down how autonomous remediation works, step-by-step, in the full blog: https://lnkd.in/eN-Af5CM
The Checkmarx Zero research team was not letting Friday slow them down. They reported this malware to Microsoft earlier today and it was taken down within four hours.
We took down a particularly nasty piece of VSCode Extensions malware today — within 4 hours of it publishing. Posting as an alternative to "Prettier" (an extremely popular legitimate extension), it deployed an Anivia Stealer malware variant that exfiltrates credentials and private information like WhatsApp chats. Thanks to our researchers quick detection and verification, and a rapid response from Microsoft, we got it quickly. 4 hours after it was published, we got it offline. We only saw 6 downloads during the time it was active. But this was no script-kiddie work; it deployed well-made malware using a multi-step payload delivery system that leaves almost no trace. And it uses multiple stealth techniques to avoid detection by static tools and endpoint security controls. It even tries to avoid running if it thinks it's in a detonation chamber. It's worth learning about how it works and what you can do to help protect your organization -- it's off the marketplace, but that doesn't mean the adversary won't try again. https://lnkd.in/gUyDH-cJ #VSCode #Malware #SupplyChainSecurity #DeveloperSecurity #AppSec #ProductSecurity #ThreatDetection #CyberThreats #OpenSourceSecurity #SoftwareSecurity #DevSecOps#CredentialTheft #StealerMalware #IncidentResponse #Microsoft #SecurityResearch #CheckmarxZero
The software we build today isn’t just “modern code”. It’s an entire museum of software eras living side-by-side. Add an AI coding tsunami, and the attack surface grows faster than legacy AppSec tools can respond. 🚀 Eran Kinsbruner breaks down what organizations are up against, and why securing multi-aged, human and AI-generated code requires a unified, developer-first, agentic AppSec platform. ⤵️
Vice President of Product Marketing at Checkmarx ⭐️ Product Marketing Alliance Top 100 & Ambassador ⭐️ Best-Selling Author ⭐️ AppSec,Agentic AI,DevOps Evangelist ⭐️ Keynote Speaker ⭐️
💡 If you think of #enterprise #software as a #museum, A living archive of legacy code, modern architectures, and now AI-generated and autonomous components - you quickly see how hard it is to maintain, secure, and innovate at the same time. As organizations rush into the AI coding era, vendors like Baxbench, Jellyfish, Anthropic, OpenAI, and Checkmarx with Checkmarx Zero are helping teams navigate this shift with clearer visibility, safer AI coding practices, and stronger defenses against emerging software supply chain risks. 🚨 But the rise of #AgenticAI demands a mindset change: Security can’t remain reactive or fragmented. It must be unified, developer-first, and deeply embedded into the creative flow, protecting every era of code without slowing innovation. Specifically for AI Coding Assistants - it must be embedded in the pre-commit phase. In this recent article, I am trying to explore this transformation. Would love your thoughts. Sandeep Johri Yigal Elstein Ori Bendet Jonathan Rende Scott Walston Benjamin Lively Ann Boyd Erez Yalon Darren Meyer Steve Boone Rebecca Spiegel Yossi Rifold Sónia Antão Scott Gainey Scott Sieper Frank Emery Avi Hein Gilad Idisis Emma Datny Laura Cleaver Nitin Kumar Dang Vivien Lim Billy Robins Brian Smitches Thomas Haver Akhil A. Ryan Wakeham Ken Huang Kailash Pathak Andrew Mallaband Katie Norton Ira Winkler Andrew Zigler Angie Jones James Berthoty
Nobody wakes up thinking, “Let me write some insecure code today.” Developers want to ship high-quality work quickly, but when security is tacked on at the end (or left entirely to AI), gaps slip in. In a recent discussion with our partner, CriticalMatrix | MatrixVentures, we heard the same thing: teams want speed and security. Developer Assist shifts security earlier in the workflow, catching issues as code is written, so teams keep their velocity and their confidence. Here’s a highlight from our conversation ⤵️
Catch us at RS CyberCon at the Cybersecurity Defense Ecosystem Summit in Toronto next week! We will join cybersecurity leaders, MSSPs, CISOs, and practitioners for a full day of deep-dive discussions on AI, supply chain risk, incident response, and the evolving challenges facing modern security teams. If you’re attending, be sure to stop by and connect! Check out Joshua Overland’s preview of what to expect from the event: https://lnkd.in/emBUJ7Gs