Semgrep

We've just pushed rules for 2 supply chain incidents happening today: first we've shipped docker code rules for SSHole the new Alpine Linux vulnerability and the strutil-core Shai-Hulud-descendent ruby gem worm.

Auto-remediation tools can scan, patch, open a PR, and sometimes merge it without a developer ever seeing the diff. Does that break “you build it, you own it”?

That’s the debate this morning at OWASP Global AppSec USA. @insiderphd takes it on with @jamesberthoty, Petra Vukmirovic (Flagstone), and Jeff Williams (Contrast Security).

9:00 to 10:00 am PST, Grand Ballroom A. The audience is part of this one, so bring your opinions.

After that, find us at booth D3 until 3:30 pm. Thanks to everyone who came to Katie and Diptendu Kar's talks yesterday and joined us at Zero Day Off on Wednesday and Off the Rails last night!

We’re excited to share that Semgrep is included in the first edition of The Forrester Wave™: Agentic Development Security Tools, Q4 2026.

Coding agents now write and change code faster than review processes built for human developers can follow. The report looks at what that shift demands from security tools: visibility and governance of agentic development, verification of AI-generated code and AI applications, and AI risk reduction at agentic speed.

Access the report: semgrep.dev/resources/acce…

Semgrep Guardian now scans with your custom rules! Teams and individual developers can choose exactly which rules it enforces, so findings match how your organization builds and coverage goes further.

And it’s not just for security. With developer rules, you can have Guardian catch the things you care about, like overly long log lines, without changing anything for the rest of your org.

See the details here: docs.semgrep.dev/semgrep-guardi…

A tampered Claude Code extension (v2.1.313) sat in Cursor’s marketplace for ~11 hours on Oct 29. Up to 5,000 devs may have installed it.

Uninstalling isn’t enough. It leaves behind scripts and an SSH key that keep working.