Semgrep

Next week at #OWASP Global AppSec USA: Nov 4, 5pm PT: Zero Day Off community night Nov 5, 10:30am: @insiderphd on reluctant devs Nov 5, 11:30am: Diptendu Kar on A04 crypto failures Nov 6, 9am: Katie debates auto-remediation semgrep.dev/events/owasp-glo… #AppSec

Code is now written at AI speed, and security has to keep up. That’s why we’re thrilled to be recognized for automating security engineering work, so teams can ship features faster with fewer vulnerabilities. Grateful to @lightspeedvp , @FortuneMagazine and @AWSstartups for including Semgrep in this year’s Cyber 60, and congrats to everyone alongside us. #Cyber60

Last week is the new normal. Wednesday to Sunday: eMudhra certs, PHP2Shell, Railway, Node2Shell/Brotli, Tailworm, and probably a couple more I've already forgotten. This is the AI vulnerability wave everyone was bracing for. These should have been non-events. If a service isn't exposed to the internet and you're patching weekly, you read the advisory and move on, confident that the service will be patched. So this is our first serious fire drill of AI vulnerabilities. Engineering and security teams can't scramble every time a bug gets a name and a logo. The answer is the basics, done consistently: 1) Shrink your attack surface. If it isn't customer-facing, it shouldn't be reachable without strong authentication. 2) Patch on a cadence, not in a crisis. Plan for containers and dependencies to update weekly. 3) Give everything you ship an owner. Unowned services are where patches go to die. Teams historically traded SDLC hygiene for speed and convenience. That trade just got a lot more expensive. And you need to figure out how to keep up with security at AI speed. How is your team handling the volume? Changing your patch cadence, or still running fire drills?

Following the Node2Shell and PHP2Shell incidents, we shipped a workflow to detect which repos may be affected: Detect-2Shell How it works: It finds where the Node or PHP version is listed in Docker image tags, .nvmrc files, IaC, and CI setup steps. First, it finds version references in Python, it checks out whether that version is 🔴 vulnerable, 🟠 unpinned, 🟢 fixed, or ⚪ unknown. Then, it uses AI to look deeper, in places where the version is inside a variable, bundled image, or built from source. The results show where there is risk and guidance for how to fix it. Detect-2Shell is now available for customers with Workflows enabled.

If you're looking at an updated Node.js, and calling CVE-2026-111497 done? We have some bad news: We likely don't even know the true scale of "Node2Shell" yet. Node patched CVE-2026-111497 on Oct 21. But the CVE wasn't in Node, it was in Brotli. So our researchers Diptendu Kar and Kurt Boberg went looking for every other package that bundles the same vulnerable Brotli decoder. Here's what we found 433 package entries across 12 ecosystems not great but the absolute worse part: Many of them don't even have fixes available yet. Now are they all reachable and exploitable? Probably not, we're finding out. But the important part: Node isn't the only affected runtime or package, not even close. We're working through the list to manually verify each one but so far we're looking at a 71% no fix yet rate, of the fixes most are still in alpha/early releases. The problem is most implementations aren't even called "brotli." The decoder is compiled into other runtimes like Chromium. 38 entries bundle Brotli older than 1.0.3. Some of those copies date to 2016, and of course are vulnerable to more than just this CVE. And there's no easy well to tell if you're affected. For example, 19 are WebAssembly builds, where memory corruption exists, but stays inside the sandbox. Some require explicit configurations to enable Brotli compression and they aren't on by default. But it's not obvious unless you are looking for it and testing for it. We're going to keep validating (and producing rules), but it's going to be a rough weekend for incident responders.

Semgrep is a launch partner in the @SpaceXSI Partner Network. In Grok Build, a Hook runs Semgrep every time the agent changes code. Not when the agent remembers to, every time. @spacerog on why that matters: semgrep.dev/blog/2026/mcp-vs…

“You can’t YOLO at enterprise scale.” @daghanaltas at #GartnerSYM this morning. Yesterday we said to come argue with him. Several people took us up on it.

PR volume: up 3.1x. Reviewers: up 1.5x. PRs getting any written feedback: 39% → 21%. Tomorrow at Gartner IT Symposium, @daghanaltas on what replaces reviewing every change by hand. Stage 3 (Pacific), 10am ET. Can’t make it: semgrep.dev/blog/2026/end-is…

Day 2 at Gartner. Edwin, our PMM: “There’s a solution for pretty much everything. What people are missing is a standard around how to secure AI.”